[5.4,058/111] macvlan: macvlan_count_rx() needs to be aware of preemption

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ]

macvlan_count_rx() can be called from process context, it is thus
necessary to disable preemption before calling u64_stats_update_begin()

syzbot was able to spot this on 32bit arch:

WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline]
WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269
Modules linked in:
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: events macvlan_process_broadcast
Backtrace:
[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
 r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4
[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline])
[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231)
 r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0
[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605)
 r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4
 r7:0000010f
[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628)
 r7:81363f70 r6:0000010f r5:83018e50 r4:00000000
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline])
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269)
 r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline])
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline])
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291)
 r5:89802300 r4:8a927740
[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317)
 r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000
 r4:89802840
[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275)
 r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80
 r4:8a86d43c
[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421)
 r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40
 r4:898dac80
[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292)
 r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40
 r4:8a97bd00
[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158)
Exception stack(0x8a9c7fb0 to 0x8a9c7ff8)

Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/if_macvlan.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20210329075617.134768780@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, Herbert Xu <herbert@gondor.apana.org.au>, syzbot <syzkaller@googlegroups.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 058/111] macvlan: macvlan_count_rx() needs to be aware of preemption Date: Mon, 29 Mar 2021 09:58:06 +0200 Message-Id: <20210329075617.134768780@linuxfoundation.org> In-Reply-To: <20210329075615.186199980@linuxfoundation.org> References: <20210329075615.186199980@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,002/111] net: fec: ptp: avoid register access when ipg clock is disabled [5.4,003/111] powerpc/4xx: Fix build errors from mfdcr() [5.4,004/111] atm: eni: dont release is never initialized [5.4,005/111] atm: lanai: dont run lanai_dev_close if not open [5.4,006/111] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" [5.4,007/111] ALSA: hda: ignore invalid NHLT table [5.4,008/111] ixgbe: Fix memleak in ixgbe_configure_clsu32 [5.4,009/111] net: tehuti: fix error return code in bdx_probe() [5.4,010/111] net: intel: iavf: fix error return code of iavf_init_get_resources() [5.4,011/111] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count [5.4,012/111] gianfar: fix jumbo packets+napi+rx overrun crash [5.4,013/111] cifs: ask for more credit on async read/write code paths [5.4,014/111] cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev [5.4,015/111] gpiolib: acpi: Add missing IRQF_ONESHOT [5.4,016/111] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default [5.4,017/111] NFS: Correct size calculation for create reply length [5.4,018/111] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() [5.4,019/111] net: wan: fix error return code of uhdlc_init() [5.4,020/111] net: davicom: Use platform_get_irq_optional() [5.4,021/111] atm: uPD98402: fix incorrect allocation [5.4,022/111] atm: idt77252: fix null-ptr-dereference [5.4,023/111] cifs: change noisy error message to FYI [5.4,024/111] irqchip/ingenic: Add support for the JZ4760 [5.4,025/111] sparc64: Fix opcode filtering in handling of no fault loads [5.4,026/111] habanalabs: Call put_pid() when releasing control device [5.4,027/111] u64_stats,lockdep: Fix u64_stats_init() vs lockdep [5.4,028/111] regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck [5.4,029/111] drm/amd/display: Revert dram_clock_change_latency for DCN2.1 [5.4,030/111] drm/amdgpu: fb BO should be ttm_bo_type_device [5.4,031/111] drm/radeon: fix AGP dependency [5.4,032/111] nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() [5.4,033/111] nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted [5.4,034/111] nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a [5.4,035/111] nfs: we dont support removing system.nfs4_acl [5.4,036/111] block: Suppress uevent for hidden device when removed [5.4,037/111] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls [5.4,038/111] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign [5.4,039/111] netsec: restore phy power state after controller reset [5.4,040/111] platform/x86: intel-vbtn: Stop reporting SW_DOCK events [5.4,041/111] squashfs: fix inode lookup sanity checks [5.4,042/111] squashfs: fix xattr id and id lookup sanity checks [5.4,043/111] kasan: fix per-page tags for non-page_alloc pages [5.4,044/111] gcov: fix clang-11+ support [5.4,045/111] ACPI: video: Add missing callback back for Sony VPCEH3U1E [5.4,046/111] arm64: dts: ls1046a: mark crypto engine dma coherent [5.4,047/111] arm64: dts: ls1012a: mark crypto engine dma coherent [5.4,048/111] arm64: dts: ls1043a: mark crypto engine dma coherent [5.4,049/111] ARM: dts: at91-sama5d27_som1: fix phy address to 7 [5.4,050/111] integrity: double check iint_cache was initialized [5.4,051/111] dm verity: fix DM_VERITY_OPTS_MAX value [5.4,052/111] dm ioctl: fix out of bounds array access when no devices [5.4,053/111] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD [5.4,054/111] veth: Store queue_mapping independently of XDP prog presence [5.4,055/111] libbpf: Fix INSTALL flag order [5.4,056/111] net/mlx5e: Dont match on Geneve options in case option masks are all zero [5.4,057/111] ipv6: fix suspecious RCU usage warning [5.4,058/111] macvlan: macvlan_count_rx() needs to be aware of preemption [5.4,059/111] net: sched: validate stab values [5.4,060/111] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port [5.4,061/111] igc: Fix Pause Frame Advertising [5.4,062/111] igc: Fix Supported Pause Frame Link Setting [5.4,063/111] e1000e: add rtnl_lock() to e1000_reset_task [5.4,064/111] e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 [5.4,065/111] net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template [5.4,066/111] ftgmac100: Restart MAC HW once [5.4,067/111] selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed [5.4,068/111] netfilter: ctnetlink: fix dump of the expect mask attribute [5.4,069/111] tcp: relookup sock for RST+ACK packets handled by obsolete req sock [5.4,070/111] can: peak_usb: add forgotten supported devices [5.4,071/111] can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate [5.4,072/111] can: kvaser_pciefd: Always disable bus load reporting [5.4,073/111] can: c_can_pci: c_can_pci_remove(): fix use-after-free [5.4,074/111] can: c_can: move runtime PM enable/disable to c_can_platform [5.4,075/111] can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning [5.4,076/111] can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors [5.4,077/111] mac80211: fix rate mask reset [5.4,078/111] nfp: flower: fix pre_tun mask id allocation [5.4,079/111] libbpf: Use SOCK_CLOEXEC when opening the netlink socket [5.4,080/111] octeontx2-af: Fix irq free in rvu teardown [5.4,081/111] octeontx2-af: fix infinite loop in unmapping NPC counter [5.4,082/111] net: cdc-phonet: fix data-interface release on probe failure [5.4,083/111] r8152: limit the RX buffer size of RTL8153A for USB 2.0 [5.4,084/111] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes [5.4,085/111] selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value [5.4,086/111] libbpf: Fix BTF dump of pointer-to-array-of-struct [5.4,087/111] drm/msm: fix shutdown hook in case GPU components failed to bind [5.4,088/111] arm64: kdump: update ppos when reading elfcorehdr [5.4,089/111] PM: runtime: Defer suspending suppliers [5.4,090/111] net/mlx5e: Fix error path for ethtool set-priv-flag [5.4,091/111] PM: EM: postpone creating the debugfs dir till fs_initcall [5.4,092/111] RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server [5.4,093/111] bpf: Dont do bpf_cgroup_storage_set() for kuprobe/tp programs [5.4,094/111] Revert "netfilter: x_tables: Switch synchronization to RCU" [5.4,095/111] netfilter: x_tables: Use correct memory barriers. [5.4,096/111] Revert "netfilter: x_tables: Update remaining dereference to RCU" [5.4,097/111] ACPI: scan: Rearrange memory allocation in acpi_device_add() [5.4,098/111] ACPI: scan: Use unique number for instance_no [5.4,099/111] perf auxtrace: Fix auxtrace queue conflict [5.4,100/111] block: recalculate segment count for multi-segment discards correctly [5.4,101/111] scsi: Revert "qla2xxx: Make sure that aborted commands are freed" [5.4,102/111] scsi: qedi: Fix error return code of qedi_alloc_global_queues() [5.4,103/111] scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() [5.4,104/111] locking/mutex: Fix non debug version of mutex_lock_io_nested() [5.4,105/111] x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() [5.4,106/111] can: dev: Move device back to init netns on owning netns delete [5.4,107/111] net: dsa: b53: VLAN filtering is global to all users [5.4,108/111] net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() [5.4,109/111] mac80211: fix double free in ibss_leave [5.4,110/111] ext4: add reclaim checks to xattr code [5.4,111/111] can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"

[5.4,058/111] macvlan: macvlan_count_rx() needs to be aware of preemption

Commit Message

Patch