Eric Dumazet c040b99461 net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() ... commit 7eb322360b upstream. qdisc_tree_reduce_backlog() is called with the qdisc lock held, not RTNL. We must use qdisc_lookup_rcu() instead of qdisc_lookup() syzbot reported: WARNING: suspicious RCU usage 6.1.74-syzkaller #0 Not tainted ----------------------------- net/sched/sch_api.c:305 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 3 locks held by udevd/1142: #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline] #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: net_tx_action+0x64a/0x970 net/core/dev.c:5282 #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline] #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: net_tx_action+0x754/0x970 net/core/dev.c:5297 #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline] #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline] #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: qdisc_tree_reduce_backlog+0x84/0x580 net/sched/sch_api.c:792 stack backtrace: CPU: 1 PID: 1142 Comm: udevd Not tainted 6.1.74-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <TASK> [<ffffffff85b85f14>] __dump_stack lib/dump_stack.c:88 [inline] [<ffffffff85b85f14>] dump_stack_lvl+0x1b1/0x28f lib/dump_stack.c:106 [<ffffffff85b86007>] dump_stack+0x15/0x1e lib/dump_stack.c:113 [<ffffffff81802299>] lockdep_rcu_suspicious+0x1b9/0x260 kernel/locking/lockdep.c:6592 [<ffffffff84f0054c>] qdisc_lookup+0xac/0x6f0 net/sched/sch_api.c:305 [<ffffffff84f037c3>] qdisc_tree_reduce_backlog+0x243/0x580 net/sched/sch_api.c:811 [<ffffffff84f5b78c>] pfifo_tail_enqueue+0x32c/0x4b0 net/sched/sch_fifo.c:51 [<ffffffff84fbcf63>] qdisc_enqueue include/net/sch_generic.h:833 [inline] [<ffffffff84fbcf63>] netem_dequeue+0xeb3/0x15d0 net/sched/sch_netem.c:723 [<ffffffff84eecab9>] dequeue_skb net/sched/sch_generic.c:292 [inline] [<ffffffff84eecab9>] qdisc_restart net/sched/sch_generic.c:397 [inline] [<ffffffff84eecab9>] __qdisc_run+0x249/0x1e60 net/sched/sch_generic.c:415 [<ffffffff84d7aa96>] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125 [<ffffffff84d85d29>] net_tx_action+0x7c9/0x970 net/core/dev.c:5313 [<ffffffff85e002bd>] __do_softirq+0x2bd/0x9bd kernel/softirq.c:616 [<ffffffff81568bca>] invoke_softirq kernel/softirq.c:447 [inline] [<ffffffff81568bca>] __irq_exit_rcu+0xca/0x230 kernel/softirq.c:700 [<ffffffff81568ae9>] irq_exit_rcu+0x9/0x20 kernel/softirq.c:712 [<ffffffff85b89f52>] sysvec_apic_timer_interrupt+0x42/0x90 arch/x86/kernel/apic/apic.c:1107 [<ffffffff85c00ccb>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:656 Fixes: d636fc5dd6 ("net: sched: add rcu annotations around qdisc->qdisc_sleeping") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://lore.kernel.org/r/20240402134133.2352776-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-04-10 16:35:51 +02:00
..
act_api.c	net: sched: Replace strlcpy with strscpy	2023-07-10 08:23:53 +01:00
act_bpf.c
act_connmark.c
act_csum.c
act_ct.c	net/sched: act_ct: fix skb leak and crash on ooo frags	2024-01-25 15:35:30 -08:00
act_ctinfo.c
act_gact.c
act_gate.c
act_ife.c
act_ipt.c	net/sched: act_ipt: zero skb->cb before calling target	2023-06-29 12:10:37 +02:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	net/sched: act_mirred: don't override retval if we already lost the skb	2024-03-01 13:35:06 +01:00
act_mpls.c
act_nat.c
act_pedit.c	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX	2023-07-04 10:31:38 +02:00
act_police.c
act_sample.c
act_simple.c
act_skbedit.c
act_skbmod.c	net/sched: act_skbmod: prevent kernel-infoleak	2024-04-10 16:35:51 +02:00
act_tunnel_key.c
act_vlan.c
cls_api.c	net/sched: flower: Fix chain template offload	2024-01-31 16:19:02 -08:00
cls_basic.c
cls_bpf.c	net: sched: cls_bpf: Undo tcf_bind_filter in case of an error	2023-07-17 07:33:39 +01:00
cls_cgroup.c
cls_flow.c
cls_flower.c	net/sched: flower: Add lock protection when remove filter handle	2024-03-01 13:35:09 +01:00
cls_fw.c	net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free	2023-07-31 20:10:36 -07:00
cls_matchall.c	net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms	2023-07-17 07:33:38 +01:00
cls_route.c	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free	2023-07-31 20:10:37 -07:00
cls_u32.c	net: sched: cls_u32: Fix allocation size in u32_init()	2023-10-06 11:43:05 +01:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c	net: annotate data-races around sk->sk_lingertime	2023-08-21 07:41:57 +01:00
em_nbyte.c
em_text.c	net: sched: em_text: fix possible memory leak in em_text_destroy()	2024-01-10 17:16:49 +01:00
em_u32.c
ematch.c
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
Makefile
sch_api.c	net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()	2024-04-10 16:35:51 +02:00
sch_blackhole.c
sch_cake.c
sch_cbs.c
sch_choke.c
sch_codel.c
sch_drr.c	net/sched: sch_drr: warn about class in use while deleting	2023-08-01 10:47:24 +02:00
sch_etf.c
sch_ets.c
sch_fifo.c
sch_fq.c
sch_fq_codel.c
sch_fq_pie.c	net/sched: fq_pie: avoid stalls in fq_pie_timer()	2023-08-31 11:21:52 +02:00
sch_frag.c
sch_generic.c
sch_gred.c
sch_hfsc.c	net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve	2023-10-18 18:08:28 -07:00
sch_hhf.c
sch_htb.c	net/sched: sch_htb: warn about class in use while deleting	2023-08-01 10:47:24 +02:00
sch_ingress.c	tcx: Fix splat in ingress_destroy upon tcx_entry_free	2023-07-24 11:42:35 -07:00
sch_mq.c
sch_mqprio.c	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64	2023-07-26 22:08:14 -07:00
sch_mqprio_lib.c
sch_mqprio_lib.h
sch_multiq.c
sch_netem.c	netem: use seeded PRNG for correlated loss events	2023-08-17 19:15:06 -07:00
sch_pie.c
sch_plug.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-05 08:54:12 +02:00
sch_prio.c
sch_qfq.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-05 08:54:12 +02:00
sch_red.c
sch_sfb.c
sch_sfq.c
sch_skbprio.c
sch_taprio.c	net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check	2024-03-26 18:20:08 -04:00
sch_tbf.c
sch_teql.c