p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bonding: fix data-races around agg_select_timer 

syzbot reported that two threads might write over agg_select_timer
at the same time. Make agg_select_timer atomic to fix the races.

BUG: KCSAN: data-race in bond_3ad_initiate_agg_selection / bond_3ad_state_machine_handler

read to 0xffff8881242aea90 of 4 bytes by task 1846 on cpu 1:
 bond_3ad_state_machine_handler+0x99/0x2810 drivers/net/bonding/bond_3ad.c:2317
 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
 worker_thread+0x616/0xa70 kernel/workqueue.c:2454
 kthread+0x1bf/0x1e0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30

write to 0xffff8881242aea90 of 4 bytes by task 25910 on cpu 0:
 bond_3ad_initiate_agg_selection+0x18/0x30 drivers/net/bonding/bond_3ad.c:1998
 bond_open+0x658/0x6f0 drivers/net/bonding/bond_main.c:3967
 __dev_open+0x274/0x3a0 net/core/dev.c:1407
 dev_open+0x54/0x190 net/core/dev.c:1443
 bond_enslave+0xcef/0x3000 drivers/net/bonding/bond_main.c:1937
 do_set_master net/core/rtnetlink.c:2532 [inline]
 do_setlink+0x94f/0x2500 net/core/rtnetlink.c:2736
 __rtnl_newlink net/core/rtnetlink.c:3414 [inline]
 rtnl_newlink+0xfeb/0x13e0 net/core/rtnetlink.c:3529
 rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
 netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg net/socket.c:725 [inline]
 ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
 ___sys_sendmsg net/socket.c:2467 [inline]
 __sys_sendmsg+0x195/0x230 net/socket.c:2496
 __do_sys_sendmsg net/socket.c:2505 [inline]
 __se_sys_sendmsg net/socket.c:2503 [inline]
 __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000050 -> 0x0000004f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25910 Comm: syz-executor.1 Tainted: G        W         5.17.0-rc4-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2022-02-14 11:15:53 -08:00 committed by David S. Miller
parent 07dd44852b
commit 9ceaf6f76b
2 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
drivers/net/bonding/bond_3ad.c
View File

@ -225,7 +225,7 @@ static inline int __check_agg_selection_timer(struct port *port)
if (bond == NULL) if (bond == NULL)
return 0; return 0;
return BOND_AD_INFO(bond).agg_select_timer ? 1 : 0; return atomic_read(&BOND_AD_INFO(bond).agg_select_timer) ? 1 : 0;
} }
/** /**
@ -1995,7 +1995,7 @@ static void ad_marker_response_received(struct bond_marker *marker,
*/ */
void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout) void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
{ {
BOND_AD_INFO(bond).agg_select_timer = timeout; atomic_set(&BOND_AD_INFO(bond).agg_select_timer, timeout);
} }
/** /**
@ -2278,6 +2278,28 @@ void bond_3ad_update_ad_actor_settings(struct bonding *bond)
spin_unlock_bh(&bond->mode_lock); spin_unlock_bh(&bond->mode_lock);
} }
/**
* bond_agg_timer_advance - advance agg_select_timer
* @bond: bonding structure
*
* Return true when agg_select_timer reaches 0.
*/
static bool bond_agg_timer_advance(struct bonding *bond)
{
int val, nval;
while (1) {
val = atomic_read(&BOND_AD_INFO(bond).agg_select_timer);
if (!val)
return false;
nval = val - 1;
if (atomic_cmpxchg(&BOND_AD_INFO(bond).agg_select_timer,
val, nval) == val)
break;
}
return nval == 0;
}
/** /**
* bond_3ad_state_machine_handler - handle state machines timeout * bond_3ad_state_machine_handler - handle state machines timeout
* @work: work context to fetch bonding struct to work on from * @work: work context to fetch bonding struct to work on from
@ -2313,9 +2335,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
if (!bond_has_slaves(bond)) if (!bond_has_slaves(bond))
goto re_arm; goto re_arm;
/* check if agg_select_timer timer after initialize is timed out */ if (bond_agg_timer_advance(bond)) {
if (BOND_AD_INFO(bond).agg_select_timer &&
!(--BOND_AD_INFO(bond).agg_select_timer)) {
slave = bond_first_slave_rcu(bond); slave = bond_first_slave_rcu(bond);
port = slave ? &(SLAVE_AD_INFO(slave)->port) : NULL; port = slave ? &(SLAVE_AD_INFO(slave)->port) : NULL;

2
include/net/bond_3ad.h
View File

@ -262,7 +262,7 @@ struct ad_system {
struct ad_bond_info { struct ad_bond_info {
struct ad_system system; /* 802.3ad system structure */ struct ad_system system; /* 802.3ad system structure */
struct bond_3ad_stats stats; struct bond_3ad_stats stats;
u32 agg_select_timer; /* Timer to select aggregator after all adapter's hand shakes */ atomic_t agg_select_timer; /* Timer to select aggregator after all adapter's hand shakes */
u16 aggregator_identifier; u16 aggregator_identifier;
}; };