[4.9,22/53] macvlan: macvlan_count_rx() needs to be aware of preemption

From: Eric Dumazet <edumazet@google.com>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ]

macvlan_count_rx() can be called from process context, it is thus
necessary to disable preemption before calling u64_stats_update_begin()

syzbot was able to spot this on 32bit arch:

WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline]
WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269
Modules linked in:
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: events macvlan_process_broadcast
Backtrace:
[<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
 r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4
[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline])
[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231)
 r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0
[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605)
 r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4
 r7:0000010f
[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628)
 r7:81363f70 r6:0000010f r5:83018e50 r4:00000000
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline])
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269)
 r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline])
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline])
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291)
 r5:89802300 r4:8a927740
[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317)
 r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000
 r4:89802840
[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275)
 r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80
 r4:8a86d43c
[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421)
 r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40
 r4:898dac80
[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292)
 r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40
 r4:8a97bd00
[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158)
Exception stack(0x8a9c7fb0 to 0x8a9c7ff8)

Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/if_macvlan.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20210329075608.271146456@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>, Herbert Xu <herbert@gondor.apana.org.au>, syzbot <syzkaller@googlegroups.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 4.9 22/53] macvlan: macvlan_count_rx() needs to be aware of preemption Date: Mon, 29 Mar 2021 09:57:57 +0200 Message-Id: <20210329075608.271146456@linuxfoundation.org> In-Reply-To: <20210329075607.561619583@linuxfoundation.org> References: <20210329075607.561619583@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,02/53] powerpc/4xx: Fix build errors from mfdcr() [4.9,03/53] atm: eni: dont release is never initialized [4.9,04/53] atm: lanai: dont run lanai_dev_close if not open [4.9,05/53] ixgbe: Fix memleak in ixgbe_configure_clsu32 [4.9,06/53] net: tehuti: fix error return code in bdx_probe() [4.9,07/53] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count [4.9,08/53] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default [4.9,09/53] NFS: Correct size calculation for create reply length [4.9,10/53] net: wan: fix error return code of uhdlc_init() [4.9,11/53] atm: uPD98402: fix incorrect allocation [4.9,12/53] atm: idt77252: fix null-ptr-dereference [4.9,13/53] u64_stats,lockdep: Fix u64_stats_init() vs lockdep [4.9,14/53] nfs: we dont support removing system.nfs4_acl [4.9,15/53] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls [4.9,16/53] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign [4.9,17/53] x86/tlb: Flush global mappings when KAISER is disabled [4.9,18/53] squashfs: fix inode lookup sanity checks [4.9,19/53] squashfs: fix xattr id and id lookup sanity checks [4.9,20/53] arm64: dts: ls1043a: mark crypto engine dma coherent [4.9,21/53] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD [4.9,22/53] macvlan: macvlan_count_rx() needs to be aware of preemption [4.9,23/53] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port [4.9,24/53] e1000e: add rtnl_lock() to e1000_reset_task [4.9,25/53] e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 [4.9,26/53] net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template [4.9,27/53] can: c_can_pci: c_can_pci_remove(): fix use-after-free [4.9,28/53] can: c_can: move runtime PM enable/disable to c_can_platform [4.9,29/53] can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning [4.9,30/53] mac80211: fix rate mask reset [4.9,31/53] net: cdc-phonet: fix data-interface release on probe failure [4.9,32/53] RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server [4.9,33/53] ACPI: scan: Rearrange memory allocation in acpi_device_add() [4.9,34/53] ACPI: scan: Use unique number for instance_no [4.9,35/53] perf auxtrace: Fix auxtrace queue conflict [4.9,36/53] idr: add ida_is_empty [4.9,37/53] futex: Use smp_store_release() in mark_wake_futex() [4.9,38/53] futex,rt_mutex: Introduce rt_mutex_init_waiter() [4.9,39/53] futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock() [4.9,40/53] futex: Drop hb->lock before enqueueing on the rtmutex [4.9,41/53] futex: Avoid freeing an active timer [4.9,42/53] futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock() [4.9,43/53] futex: Handle early deadlock return correctly [4.9,44/53] futex: Fix (possible) missed wakeup [4.9,45/53] locking/futex: Allow low-level atomic operations to return -EAGAIN [4.9,46/53] arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP [4.9,47/53] futex: Prevent robust futex exit race [4.9,48/53] futex: Fix incorrect should_fail_futex() handling [4.9,49/53] futex: Handle transient "ownerless" rtmutex state correctly [4.9,50/53] can: dev: Move device back to init netns on owning netns delete [4.9,51/53] net: sched: validate stab values [4.9,52/53] net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() [4.9,53/53] mac80211: fix double free in ibss_leave

[4.9,22/53] macvlan: macvlan_count_rx() needs to be aware of preemption

Commit Message

Patch