Eric Dumazet cd69bf3377 ipv6: make ip6_rt_gc_expire an atomic_t ... [ Upstream commit 9cb7c01342 ] Reads and Writes to ip6_rt_gc_expire always have been racy, as syzbot reported lately [1] There is a possible risk of under-flow, leading to unexpected high value passed to fib6_run_gc(), although I have not observed this in the field. Hosts hitting ip6_dst_gc() very hard are under pretty bad state anyway. [1] BUG: KCSAN: data-race in ip6_dst_gc / ip6_dst_gc read-write to 0xffff888102110744 of 4 bytes by task 13165 on cpu 1: ip6_dst_gc+0x1f3/0x220 net/ipv6/route.c:3311 dst_alloc+0x9b/0x160 net/core/dst.c:86 ip6_dst_alloc net/ipv6/route.c:344 [inline] icmp6_dst_alloc+0xb2/0x360 net/ipv6/route.c:3261 mld_sendpack+0x2b9/0x580 net/ipv6/mcast.c:1807 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x576/0x800 net/ipv6/mcast.c:2651 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 read-write to 0xffff888102110744 of 4 bytes by task 11607 on cpu 0: ip6_dst_gc+0x1f3/0x220 net/ipv6/route.c:3311 dst_alloc+0x9b/0x160 net/core/dst.c:86 ip6_dst_alloc net/ipv6/route.c:344 [inline] icmp6_dst_alloc+0xb2/0x360 net/ipv6/route.c:3261 mld_sendpack+0x2b9/0x580 net/ipv6/mcast.c:1807 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x576/0x800 net/ipv6/mcast.c:2651 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 value changed: 0x00000bb3 -> 0x00000ba9 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 11607 Comm: kworker/0:21 Not tainted 5.18.0-rc1-syzkaller-00037-g42e7a03d3bad-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: mld mld_ifc_work Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/20220413181333.649424-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-27 14:41:01 +02:00
..
acpi
asm-generic	tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry	2022-04-20 09:36:21 +02:00
clocksource
crypto	lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI	2022-02-04 19:22:32 +01:00
drm	drm/connector: Fix typo in documentation	2022-04-08 13:58:58 +02:00
dt-bindings	Fixes for omaps	2022-02-07 17:42:44 +01:00
keys
kunit	kunit: replace kernel.h with the necessary inclusions	2022-01-20 08:52:54 +02:00
kvm	RISCV:	2022-01-16 16:15:14 +02:00
linux	etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead	2022-04-27 14:40:53 +02:00
math-emu
media
memory
misc
net	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-27 14:41:01 +02:00
pcmcia
ras	mm/hwpoison: remove MF_MSG_BUDDY_2ND and MF_MSG_POISONED_HUGE	2022-01-15 16:30:31 +02:00
rdma
scsi	scsi: iscsi: Fix conn cleanup and stop race during iscsid restart	2022-04-20 09:36:16 +02:00
soc	soc: fsl: Replace kernel.h with the necessary inclusions	2022-02-18 17:11:17 -06:00
sound	ALSA: memalloc: Add fallback SG-buffer allocations for x86	2022-04-20 09:36:11 +02:00
target
trace	SUNRPC: Fix the svc_deferred_event trace class	2022-04-20 09:36:12 +02:00
uapi	io_uring: flag the fact that linked file assignment is sane	2022-04-20 09:36:14 +02:00
vdso
video
xen	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-07 09:48:55 +01:00