[5.5,48/65] net: rmnet: fix suspicious RCU usage

From: Taehee Yoo <ap420073@gmail.com>

From: Taehee Yoo <ap420073@gmail.com>

[ Upstream commit 102210f7664442d8c0ce332c006ea90626df745b ]

rmnet_get_port() internally calls rcu_dereference_rtnl(),
which checks RTNL.
But rmnet_get_port() could be called by packet path.
The packet path is not protected by RTNL.
So, the suspicious RCU usage problem occurs.

Test commands:
    modprobe rmnet
    ip netns add nst
    ip link add veth0 type veth peer name veth1
    ip link set veth1 netns nst
    ip link add rmnet0 link veth0 type rmnet mux_id 1
    ip netns exec nst ip link add rmnet1 link veth1 type rmnet mux_id 1
    ip netns exec nst ip link set veth1 up
    ip netns exec nst ip link set rmnet1 up
    ip netns exec nst ip a a 192.168.100.2/24 dev rmnet1
    ip link set veth0 up
    ip link set rmnet0 up
    ip a a 192.168.100.1/24 dev rmnet0
    ping 192.168.100.2

Splat looks like:
[  146.630958][ T1174] WARNING: suspicious RCU usage
[  146.631735][ T1174] 5.6.0-rc1+ #447 Not tainted
[  146.632387][ T1174] -----------------------------
[  146.633151][ T1174] drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c:386 suspicious rcu_dereference_check() !
[  146.634742][ T1174]
[  146.634742][ T1174] other info that might help us debug this:
[  146.634742][ T1174]
[  146.645992][ T1174]
[  146.645992][ T1174] rcu_scheduler_active = 2, debug_locks = 1
[  146.646937][ T1174] 5 locks held by ping/1174:
[  146.647609][ T1174]  #0: ffff8880c31dea70 (sk_lock-AF_INET){+.+.}, at: raw_sendmsg+0xab8/0x2980
[  146.662463][ T1174]  #1: ffffffff93925660 (rcu_read_lock_bh){....}, at: ip_finish_output2+0x243/0x2150
[  146.671696][ T1174]  #2: ffffffff93925660 (rcu_read_lock_bh){....}, at: __dev_queue_xmit+0x213/0x2940
[  146.673064][ T1174]  #3: ffff8880c19ecd58 (&dev->qdisc_running_key#7){+...}, at: ip_finish_output2+0x714/0x2150
[  146.690358][ T1174]  #4: ffff8880c5796898 (&dev->qdisc_xmit_lock_key#3){+.-.}, at: sch_direct_xmit+0x1e2/0x1020
[  146.699875][ T1174]
[  146.699875][ T1174] stack backtrace:
[  146.701091][ T1174] CPU: 0 PID: 1174 Comm: ping Not tainted 5.6.0-rc1+ #447
[  146.705215][ T1174] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  146.706565][ T1174] Call Trace:
[  146.707102][ T1174]  dump_stack+0x96/0xdb
[  146.708007][ T1174]  rmnet_get_port.part.9+0x76/0x80 [rmnet]
[  146.709233][ T1174]  rmnet_egress_handler+0x107/0x420 [rmnet]
[  146.710492][ T1174]  ? sch_direct_xmit+0x1e2/0x1020
[  146.716193][ T1174]  rmnet_vnd_start_xmit+0x3d/0xa0 [rmnet]
[  146.717012][ T1174]  dev_hard_start_xmit+0x160/0x740
[  146.717854][ T1174]  sch_direct_xmit+0x265/0x1020
[  146.718577][ T1174]  ? register_lock_class+0x14d0/0x14d0
[  146.719429][ T1174]  ? dev_watchdog+0xac0/0xac0
[  146.723738][ T1174]  ? __dev_queue_xmit+0x15fd/0x2940
[  146.724469][ T1174]  ? lock_acquire+0x164/0x3b0
[  146.725172][ T1174]  __dev_queue_xmit+0x20c7/0x2940
[ ... ]

Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c  | 13 ++++++-------
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h  |  2 +-
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c    |  4 ++--
 3 files changed, 9 insertions(+), 10 deletions(-)

Message ID	20200319123941.528206596@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=1QoN=5E=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Taehee Yoo <ap420073@gmail.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.5 48/65] net: rmnet: fix suspicious RCU usage Date: Thu, 19 Mar 2020 14:04:30 +0100 Message-Id: <20200319123941.528206596@linuxfoundation.org> In-Reply-To: <20200319123926.466988514@linuxfoundation.org> References: <20200319123926.466988514@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.5,02/65] pinctrl: qcom: ssbi-gpio: Fix fwspec parsing bug [5.5,05/65] mmc: sdhci-tegra: Fix busy detection by enabling MMC_CAP_NEED_RSP_BUSY [5.5,07/65] mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for eMMC sleep command [5.5,08/65] mmc: core: Respect MMC_CAP_NEED_RSP_BUSY for erase/trim/discard [5.5,09/65] ACPI: watchdog: Allow disabling WDAT at boot [5.5,10/65] HID: apple: Add support for recent firmware on Magic Keyboards [5.5,11/65] ACPI: watchdog: Set default timeout in probe [5.5,13/65] mips: vdso: fix jalr t9 crash in vdso code [5.5,16/65] HID: hid-bigbenff: fix general protection fault caused by double kfree [5.5,17/65] HID: hid-bigbenff: call hid_hw_stop() in case of error [5.5,19/65] riscv: set pmp configuration if kernel is running in M-mode [5.5,20/65] MIPS: vdso: Wrap -mexplicit-relocs in cc-option [5.5,22/65] selftests/rseq: Fix out-of-tree compilation [5.5,25/65] scsi: libfc: free response frame from GPN_ID [5.5,27/65] net: ks8851-ml: Fix IRQ handling and locking [5.5,29/65] net: ll_temac: Fix race condition causing TX hang [5.5,32/65] net: ll_temac: Handle DMA halt condition caused by buffer underrun [5.5,35/65] drm/amdgpu: fix memory leak during TDR test(v2) [5.5,38/65] kbuild: add dt_binding_check to PHONY in a correct place [5.5,39/65] signal: avoid double atomic counter increments for user accounting [5.5,41/65] slip: not call free_netdev before rtnl_unlock in slip_open [5.5,43/65] hinic: fix a irq affinity bug [5.5,46/65] net: rmnet: fix NULL pointer dereference in rmnet_newlink() [5.5,47/65] net: rmnet: fix NULL pointer dereference in rmnet_changelink() [5.5,48/65] net: rmnet: fix suspicious RCU usage [5.5,49/65] net: rmnet: remove rcu_read_lock in rmnet_force_unassociate_device() [5.5,51/65] net: rmnet: use upper/lower device infrastructure [5.5,52/65] net: rmnet: fix bridge mode bugs [5.5,54/65] sfc: fix timestamp reconstruction at 16-bit rollover points [5.5,56/65] net: dsa: mv88e6xxx: Fix masking of egress port [5.5,59/65] ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional() [5.5,62/65] HID: google: add moonball USB id [5.5,64/65] ARM: 8961/2: Fix Kbuild issue caused by per-task stack protector GCC plugin

[5.5,48/65] net: rmnet: fix suspicious RCU usage

Commit Message

Patch