Eric Dumazet
ad8d39c7b4
net: bridge: use DEV_STATS_INC() ...
[ Upstream commit 44bdb313da57322c9b3c108eb66981c6ec6509f4 ]
syzbot/KCSAN reported data-races in br_handle_frame_finish() [1]
This function can run from multiple cpus without mutual exclusion.
Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.
Handles updates to dev->stats.tx_dropped while we are at it.
[1]
BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish
read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:
br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189
br_nf_hook_thresh+0x1ed/0x220
br_nf_pre_routing_finish_ipv6+0x50f/0x540
NF_HOOK include/linux/netfilter.h:304 [inline]
br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178
br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:272 [inline]
br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417
__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417
__netif_receive_skb_one_core net/core/dev.c:5521 [inline]
__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637
process_backlog+0x21f/0x380 net/core/dev.c:5965
__napi_poll+0x60/0x3b0 net/core/dev.c:6527
napi_poll net/core/dev.c:6594 [inline]
net_rx_action+0x32b/0x750 net/core/dev.c:6727
__do_softirq+0xc1/0x265 kernel/softirq.c:553
run_ksoftirqd+0x17/0x20 kernel/softirq.c:921
smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164
kthread+0x1d7/0x210 kernel/kthread.c:388
ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:
br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189
br_nf_hook_thresh+0x1ed/0x220
br_nf_pre_routing_finish_ipv6+0x50f/0x540
NF_HOOK include/linux/netfilter.h:304 [inline]
br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178
br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:272 [inline]
br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417
__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417
__netif_receive_skb_one_core net/core/dev.c:5521 [inline]
__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637
process_backlog+0x21f/0x380 net/core/dev.c:5965
__napi_poll+0x60/0x3b0 net/core/dev.c:6527
napi_poll net/core/dev.c:6594 [inline]
net_rx_action+0x32b/0x750 net/core/dev.c:6727
__do_softirq+0xc1/0x265 kernel/softirq.c:553
do_softirq+0x5e/0x90 kernel/softirq.c:454
__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
spin_unlock_bh include/linux/spinlock.h:396 [inline]
batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356
batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560
process_one_work kernel/workqueue.c:2630 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703
worker_thread+0x525/0x730 kernel/workqueue.c:2784
kthread+0x1d7/0x210 kernel/kthread.c:388
ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
value changed: 0x00000000000d7190 -> 0x00000000000d7191
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0
Fixes: 1c29fc4989bc ("[BRIDGE]: keep track of received multicast packets")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: bridge@lists.linux-foundation.org
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230918091351.1356153-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-10-10 21:46:37 +02:00
2021-09-15 09:47:31 +02:00
2023-09-23 10:59:37 +02:00
2023-01-18 11:41:37 +01:00
2023-05-30 12:44:06 +01:00
2021-04-07 14:47:41 +02:00
2023-06-09 10:28:59 +02:00
2022-04-20 09:19:40 +02:00
2023-08-30 16:27:25 +02:00
2023-08-30 16:27:11 +02:00
2023-01-18 11:41:04 +01:00
2021-07-14 16:53:33 +02:00
2023-10-10 21:46:37 +02:00
2023-03-17 08:32:51 +01:00
2023-07-27 08:37:40 +02:00
2023-08-11 11:53:58 +02:00
2023-09-23 11:00:03 +02:00
2023-08-11 11:53:57 +02:00
2023-10-10 21:46:37 +02:00
2023-06-21 15:44:10 +02:00
2020-04-23 10:36:45 +02:00
2023-07-27 08:37:24 +02:00
2023-01-18 11:41:09 +01:00
2022-11-03 23:56:54 +09:00
2023-10-10 21:46:37 +02:00
2023-09-23 10:59:58 +02:00
2023-04-20 12:07:32 +02:00
2023-09-23 11:00:02 +02:00
2023-08-30 16:27:16 +02:00
2023-04-26 11:24:05 +02:00
2022-04-27 13:50:47 +02:00
2021-02-10 09:25:28 +01:00
2023-07-27 08:37:44 +02:00
2023-04-20 12:07:33 +02:00
2022-12-14 11:30:45 +01:00
2023-02-22 12:50:41 +01:00
2023-08-30 16:27:14 +02:00
2023-10-10 21:46:36 +02:00
2023-09-23 10:59:39 +02:00
2023-07-27 08:37:12 +02:00
2023-09-23 10:59:43 +02:00
2023-07-27 08:37:11 +02:00
2023-05-30 12:44:05 +01:00
2023-02-22 12:50:25 +01:00
2023-08-16 18:19:23 +02:00
2022-01-11 15:23:33 +01:00
2021-09-03 10:08:12 +02:00
2023-03-11 16:43:41 +01:00
2020-11-24 13:29:05 +01:00
2023-02-22 12:50:34 +01:00
2023-05-17 11:35:59 +02:00
2023-09-23 11:00:07 +02:00
2023-09-23 10:59:58 +02:00
2023-03-17 08:32:51 +01:00
2021-11-17 09:48:48 +01:00
2023-10-10 21:46:35 +02:00
2021-10-27 09:54:24 +02:00
2023-06-21 15:44:12 +02:00
2023-09-23 11:00:02 +02:00
2023-09-23 10:59:58 +02:00
2023-05-30 12:44:05 +01:00
2023-07-27 08:37:42 +02:00
2023-02-22 12:50:26 +01:00
2023-07-27 08:37:23 +02:00
2023-08-30 16:27:20 +02:00
2021-06-18 09:59:00 +02:00
2023-06-21 15:44:10 +02:00
2023-06-21 15:44:10 +02:00
2023-09-23 10:59:39 +02:00
ad8d39c7b4