• Taehee Yoo's avatar
    bonding: fix suspicious RCU usage in bond_ipsec_add_sa() · b648eba4
    Taehee Yoo authored
    To dereference bond->curr_active_slave, it uses rcu_dereference().
    But it and the caller doesn't acquire RCU so a warning occurs.
    So add rcu_read_lock().
    
    Test commands:
        ip link add dummy0 type dummy
        ip link add bond0 type bond
        ip link set dummy0 master bond0
        ip link set dummy0 up
        ip link set bond0 up
        ip x s add proto esp dst 14.1.1.1 src 15.1.1.1 spi 0x07 \
    	    mode transport \
    	    reqid 0x07 replay-window 32 aead 'rfc4106(gcm(aes))' \
    	    0x44434241343332312423222114131211f4f3f2f1 128 sel \
    	    src 14.0.0.52/24 dst 14.0.0.70/24 proto tcp offload \
    	    dev bond0 dir in
    
    Splat looks like:
    =============================
    WARNING: suspicious RCU usage
    5.13.0-rc3+ #1168 Not tainted
    -----------------------------
    drivers/net/bonding/bond_main.c:411 suspicious rcu_dereference_check() usage!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    1 lock held by ip/684:
     #0: ffffffff9a2757c0 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{3:3},
    at: xfrm_netlink_rcv+0x59/0x80 [xfrm_user]
       55.191733][  T684] stack backtrace:
    CPU: 0 PID: 684 Comm: ip Not tainted 5.13.0-rc3+ #1168
    Call Trace:
     dump_stack+0xa4/0xe5
     bond_ipsec_add_sa+0x18c/0x1f0 [bonding]
     xfrm_dev_state_add+0x2a9/0x770
     ? memcpy+0x38/0x60
     xfrm_add_sa+0x2278/0x3b10 [xfrm_user]
     ? xfrm_get_policy+0xaa0/0xaa0 [xfrm_user]
     ? register_lock_class+0x1750/0x1750
     xfrm_user_rcv_msg+0x331/0x660 [xfrm_user]
     ? rcu_read_lock_sched_held+0x91/0xc0
     ? xfrm_user_state_lookup.constprop.39+0x320/0x320 [xfrm_user]
     ? find_held_lock+0x3a/0x1c0
     ? mutex_lock_io_nested+0x1210/0x1210
     ? sched_clock_cpu+0x18/0x170
     netlink_rcv_skb+0x121/0x350
     ? xfrm_user_state_lookup.constprop.39+0x320/0x320 [xfrm_user]
     ? netlink_ack+0x9d0/0x9d0
     ? netlink_deliver_tap+0x17c/0xa50
     xfrm_netlink_rcv+0x68/0x80 [xfrm_user]
     netlink_unicast+0x41c/0x610
     ? netlink_attachskb+0x710/0x710
     netlink_sendmsg+0x6b9/0xb70
    [ ... ]
    
    Fixes: 18cb261a ("bonding: support hardware encryption offload to slaves")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    b648eba4
bond_main.c 152 KB