Eric Dumazet fa973bf5fd net: annotate data-races on txq->xmit_lock_owner ... commit 7a10d8c810 upstream. syzbot found that __dev_queue_xmit() is reading txq->xmit_lock_owner without annotations. No serious issue there, let's document what is happening there. BUG: KCSAN: data-race in __dev_queue_xmit / __dev_queue_xmit write to 0xffff888139d09484 of 4 bytes by interrupt on cpu 0: __netif_tx_unlock include/linux/netdevice.h:4437 [inline] __dev_queue_xmit+0x948/0xf70 net/core/dev.c:4229 dev_queue_xmit_accel+0x19/0x20 net/core/dev.c:4265 macvlan_queue_xmit drivers/net/macvlan.c:543 [inline] macvlan_start_xmit+0x2b3/0x3d0 drivers/net/macvlan.c:567 __netdev_start_xmit include/linux/netdevice.h:4987 [inline] netdev_start_xmit include/linux/netdevice.h:5001 [inline] xmit_one+0x105/0x2f0 net/core/dev.c:3590 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606 sch_direct_xmit+0x1b2/0x7c0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x83d/0x1370 net/core/dev.c:3817 __dev_queue_xmit+0x590/0xf70 net/core/dev.c:4194 dev_queue_xmit+0x13/0x20 net/core/dev.c:4259 neigh_hh_output include/net/neighbour.h:511 [inline] neigh_output include/net/neighbour.h:525 [inline] ip6_finish_output2+0x995/0xbb0 net/ipv6/ip6_output.c:126 __ip6_finish_output net/ipv6/ip6_output.c:191 [inline] ip6_finish_output+0x444/0x4c0 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ndisc_send_skb+0x486/0x610 net/ipv6/ndisc.c:508 ndisc_send_rs+0x3b0/0x3e0 net/ipv6/ndisc.c:702 addrconf_rs_timer+0x370/0x540 net/ipv6/addrconf.c:3898 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1421 expire_timers+0x116/0x240 kernel/time/timer.c:1466 __run_timers+0x368/0x410 kernel/time/timer.c:1734 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1747 __do_softirq+0x158/0x2de kernel/softirq.c:558 __irq_exit_rcu kernel/softirq.c:636 [inline] irq_exit_rcu+0x37/0x70 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x3e/0xb0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 read to 0xffff888139d09484 of 4 bytes by interrupt on cpu 1: __dev_queue_xmit+0x5e3/0xf70 net/core/dev.c:4213 dev_queue_xmit_accel+0x19/0x20 net/core/dev.c:4265 macvlan_queue_xmit drivers/net/macvlan.c:543 [inline] macvlan_start_xmit+0x2b3/0x3d0 drivers/net/macvlan.c:567 __netdev_start_xmit include/linux/netdevice.h:4987 [inline] netdev_start_xmit include/linux/netdevice.h:5001 [inline] xmit_one+0x105/0x2f0 net/core/dev.c:3590 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606 sch_direct_xmit+0x1b2/0x7c0 net/sched/sch_generic.c:342 __dev_xmit_skb+0x83d/0x1370 net/core/dev.c:3817 __dev_queue_xmit+0x590/0xf70 net/core/dev.c:4194 dev_queue_xmit+0x13/0x20 net/core/dev.c:4259 neigh_resolve_output+0x3db/0x410 net/core/neighbour.c:1523 neigh_output include/net/neighbour.h:527 [inline] ip6_finish_output2+0x9be/0xbb0 net/ipv6/ip6_output.c:126 __ip6_finish_output net/ipv6/ip6_output.c:191 [inline] ip6_finish_output+0x444/0x4c0 net/ipv6/ip6_output.c:201 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:224 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] ndisc_send_skb+0x486/0x610 net/ipv6/ndisc.c:508 ndisc_send_rs+0x3b0/0x3e0 net/ipv6/ndisc.c:702 addrconf_rs_timer+0x370/0x540 net/ipv6/addrconf.c:3898 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1421 expire_timers+0x116/0x240 kernel/time/timer.c:1466 __run_timers+0x368/0x410 kernel/time/timer.c:1734 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1747 __do_softirq+0x158/0x2de kernel/softirq.c:558 __irq_exit_rcu kernel/softirq.c:636 [inline] irq_exit_rcu+0x37/0x70 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 kcsan_setup_watchpoint+0x94/0x420 kernel/kcsan/core.c:443 folio_test_anon include/linux/page-flags.h:581 [inline] PageAnon include/linux/page-flags.h:586 [inline] zap_pte_range+0x5ac/0x10e0 mm/memory.c:1347 zap_pmd_range mm/memory.c:1467 [inline] zap_pud_range mm/memory.c:1496 [inline] zap_p4d_range mm/memory.c:1517 [inline] unmap_page_range+0x2dc/0x3d0 mm/memory.c:1538 unmap_single_vma+0x157/0x210 mm/memory.c:1583 unmap_vmas+0xd0/0x180 mm/memory.c:1615 exit_mmap+0x23d/0x470 mm/mmap.c:3170 __mmput+0x27/0x1b0 kernel/fork.c:1113 mmput+0x3d/0x50 kernel/fork.c:1134 exit_mm+0xdb/0x170 kernel/exit.c:507 do_exit+0x608/0x17a0 kernel/exit.c:819 do_group_exit+0xce/0x180 kernel/exit.c:929 get_signal+0xfc3/0x1550 kernel/signal.c:2852 arch_do_signal_or_restart+0x8c/0x2e0 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x113/0x190 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300 do_syscall_64+0x50/0xd0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000 -> 0xffffffff Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 28712 Comm: syz-executor.0 Tainted: G W 5.16.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Link: https://lore.kernel.org/r/20211130170155.2331929-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-08 09:03:25 +01:00
..
bpf_sk_storage.c	bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON	2020-09-25 13:58:01 -07:00
datagram.c	udp: fix skb_copy_and_csum_datagram with odd segment sizes	2021-02-17 11:02:28 +01:00
datagram.h
dev.c	net: annotate data-races on txq->xmit_lock_owner	2021-12-08 09:03:25 +01:00
dev_addr_lists.c	net: core: add nested_level variable in net_device	2020-09-28 15:00:15 -07:00
dev_ioctl.c	net: fix dev_ifsioc_locked() race condition	2021-03-07 12:34:07 +01:00
devlink.c	devlink: Clear whole devlink_flash_notify struct	2021-09-15 09:50:40 +02:00
drop_monitor.c	drop_monitor: Perform cleanup upon probe registration failure	2021-03-30 14:31:57 +02:00
dst.c	net, bpf: Fix ip6ip6 crash with collect_md populated skbs	2021-03-30 14:32:05 +02:00
dst_cache.c	wireguard: device: reset peer src endpoint when netns exits	2021-12-08 09:03:22 +01:00
failover.c
fib_notifier.c
fib_rules.c	ipv6: fix memory leak in fib6_rule_suppress	2021-12-08 09:03:21 +01:00
filter.c	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
flow_dissector.c	flow_dissector: Fix out-of-bounds warnings	2021-09-18 13:40:22 +02:00
flow_offload.c	net: Fix offloading indirect devices dependency on qdisc order creation	2021-09-18 13:40:30 +02:00
gen_estimator.c	net_sched: gen_estimator: support large ewma log	2021-01-27 11:55:23 +01:00
gen_stats.c	docs: networking: convert gen_stats.txt to ReST	2020-04-28 14:39:46 -07:00
gro_cells.c	gro_cells: reduce number of synchronize_net() calls	2020-11-25 11:28:12 -08:00
hwbm.c
link_watch.c	net: linkwatch: fix failure to restore device state across suspend/resume	2021-08-18 08:59:13 +02:00
lwt_bpf.c	lwt_bpf: Replace preempt_disable() with migrate_disable()	2020-12-07 11:53:40 -08:00
lwtunnel.c
Makefile
neighbour.c	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE	2021-11-18 14:04:29 +01:00
net-procfs.c	net-sysfs: add backlog len and CPU id to softnet data	2020-09-21 13:56:37 -07:00
net-sysfs.c	net-sysfs: try not to restart the syscall if it will fail eventually	2021-11-18 14:03:56 +01:00
net-sysfs.h
net-traces.c
net_namespace.c	net: net_namespace: Fix undefined member in key_remove_domain()	2021-11-18 14:04:02 +01:00
netclassid_cgroup.c
netevent.c
netpoll.c	net: Have netpoll bring-up DSA management interface	2020-11-18 11:04:11 -08:00
netprio_cgroup.c	netprio_cgroup: Fix unlimited memory leak of v2 cgroups	2020-05-09 20:59:21 -07:00
page_pool.c	mm: fix struct page layout on 32-bit systems	2021-05-19 10:13:17 +02:00
pktgen.c	pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()	2021-03-07 12:34:09 +01:00
ptp_classifier.c	ptp: Add generic ptp v2 header parsing function	2020-08-19 16:07:49 -07:00
request_sock.c
rtnetlink.c	rtnetlink: fix if_nlmsg_stats_size() under estimation	2021-10-13 10:04:28 +02:00
scm.c	fs: Add receive_fd() wrapper for __receive_fd()	2020-07-13 11:03:44 -07:00
secure_seq.c	crypto: lib/sha1 - remove unnecessary includes of linux/cryptohash.h	2020-05-08 15:32:17 +10:00
skbuff.c	net: Fix zero-copy head len calculation.	2021-08-08 09:05:23 +02:00
skmsg.c	skmsg: Make sk_psock_destroy() static	2021-08-04 12:46:44 +02:00
sock.c	sock: fix /proc/net/sockstat underflow in sk_clone_lock()	2021-11-26 10:39:14 +01:00
sock_diag.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
sock_map.c	net, sockmap: Don't call bpf_prog_put() on NULL pointer	2020-10-15 21:05:23 +02:00
sock_reuseport.c	udp: Prevent reuseport_select_sock from reading uninitialized socks	2021-01-23 16:03:59 +01:00
stream.c	net: stream: don't purge sk_error_queue in sk_stream_kill_queues()	2021-11-18 14:04:08 +01:00
sysctl_net_core.c	bpf: Prevent increasing bpf_jit_limit above max	2021-11-18 14:03:42 +01:00
timestamping.c
tso.c	net: tso: add UDP segmentation support	2020-06-18 20:46:23 -07:00
utils.c
xdp.c	xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model	2021-04-14 08:42:09 +02:00