• Eric Dumazet's avatar
    inetpeer: fix data-race in inet_putpeer / inet_putpeer · 71685eb4
    Eric Dumazet authored
    We need to explicitely forbid read/store tearing in inet_peer_gc()
    and inet_putpeer().
    
    The following syzbot report reminds us about inet_putpeer()
    running without a lock held.
    
    BUG: KCSAN: data-race in inet_putpeer / inet_putpeer
    
    write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 0:
     inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240
     ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102
     inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228
     __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
     rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157
     rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377
     rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386
     __do_softirq+0x115/0x33f kernel/softirq.c:292
     invoke_softirq kernel/softirq.c:373 [inline]
     irq_exit+0xbb/0xe0 kernel/softirq.c:413
     exiting_irq arch/x86/include/asm/apic.h:536 [inline]
     smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
     apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
     native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
     arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
     default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
     cpuidle_idle_call kernel/sched/idle.c:154 [inline]
     do_idle+0x1af/0x280 kernel/sched/idle.c:263
    
    write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 1:
     inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240
     ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102
     inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228
     __rcu_reclaim kernel/rcu/rcu.h:222 [inline]
     rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157
     rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377
     rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386
     __do_softirq+0x115/0x33f kernel/softirq.c:292
     run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
     smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
     kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc3+ #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Fixes: 4b9d9be8 ("inetpeer: remove unused list")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    71685eb4
inetpeer.c 8.52 KB