mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-21 00:39:33 +07:00
92a35678ec
hsr nodes are protected by RCU and there is no write side lock.
But node insertions and deletions could be being operated concurrently.
So write side locking is needed.
Test commands:
ip netns add nst
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth3
ip link set veth1 netns nst
ip link set veth3 netns nst
ip link set veth0 up
ip link set veth2 up
ip link add hsr0 type hsr slave1 veth0 slave2 veth2
ip a a 192.168.100.1/24 dev hsr0
ip link set hsr0 up
ip netns exec nst ip link set veth1 up
ip netns exec nst ip link set veth3 up
ip netns exec nst ip link add hsr1 type hsr slave1 veth1 slave2 veth3
ip netns exec nst ip a a 192.168.100.2/24 dev hsr1
ip netns exec nst ip link set hsr1 up
for i in {0..9}
do
for j in {0..9}
do
for k in {0..9}
do
for l in {0..9}
do
arping 192.168.100.2 -I hsr0 -s 00:01:3$i:4$j:5$k:6$l -c1 &
done
done
done
done
Splat looks like:
[ 236.066091][ T3286] list_add corruption. next->prev should be prev (ffff8880a5940300), but was ffff8880a5940d0.
[ 236.069617][ T3286] ------------[ cut here ]------------
[ 236.070545][ T3286] kernel BUG at lib/list_debug.c:25!
[ 236.071391][ T3286] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 236.072343][ T3286] CPU: 0 PID: 3286 Comm: arping Tainted: G W 5.5.0-rc1+ #209
[ 236.073463][ T3286] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 236.074695][ T3286] RIP: 0010:__list_add_valid+0x74/0xd0
[ 236.075499][ T3286] Code: 48 39 da 75 27 48 39 f5 74 36 48 39 dd 74 31 48 83 c4 08 b8 01 00 00 00 5b 5d c3 48 b
[ 236.078277][ T3286] RSP: 0018:ffff8880aaa97648 EFLAGS: 00010286
[ 236.086991][ T3286] RAX: 0000000000000075 RBX: ffff8880d4624c20 RCX: 0000000000000000
[ 236.088000][ T3286] RDX: 0000000000000075 RSI: 0000000000000008 RDI: ffffed1015552ebf
[ 236.098897][ T3286] RBP: ffff88809b53d200 R08: ffffed101b3c04f9 R09: ffffed101b3c04f9
[ 236.099960][ T3286] R10: 00000000308769a1 R11: ffffed101b3c04f8 R12: ffff8880d4624c28
[ 236.100974][ T3286] R13: ffff8880d4624c20 R14: 0000000040310100 R15: ffff8880ce17ee02
[ 236.138967][ T3286] FS: 00007f23479fa680(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000
[ 236.144852][ T3286] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 236.145720][ T3286] CR2: 00007f4a14bab210 CR3: 00000000a61c6001 CR4: 00000000000606f0
[ 236.146776][ T3286] Call Trace:
[ 236.147222][ T3286] hsr_add_node+0x314/0x490 [hsr]
[ 236.153633][ T3286] hsr_forward_skb+0x2b6/0x1bc0 [hsr]
[ 236.154362][ T3286] ? rcu_read_lock_sched_held+0x90/0xc0
[ 236.155091][ T3286] ? rcu_read_lock_bh_held+0xa0/0xa0
[ 236.156607][ T3286] hsr_dev_xmit+0x70/0xd0 [hsr]
[ 236.157254][ T3286] dev_hard_start_xmit+0x160/0x740
[ 236.157941][ T3286] __dev_queue_xmit+0x1961/0x2e10
[ 236.158565][ T3286] ? netdev_core_pick_tx+0x2e0/0x2e0
[ ... ]
Reported-by: syzbot+3924327f9ad5f4d2b343@syzkaller.appspotmail.com
Fixes: f421436a59
("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
135 lines
3.1 KiB
C
135 lines
3.1 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/* Copyright 2011-2014 Autronica Fire and Security AS
|
|
*
|
|
* Author(s):
|
|
* 2011-2014 Arvid Brodin, arvid.brodin@alten.se
|
|
*/
|
|
|
|
#include <linux/netdevice.h>
|
|
#include <linux/rculist.h>
|
|
#include <linux/timer.h>
|
|
#include <linux/etherdevice.h>
|
|
#include "hsr_main.h"
|
|
#include "hsr_device.h"
|
|
#include "hsr_netlink.h"
|
|
#include "hsr_framereg.h"
|
|
#include "hsr_slave.h"
|
|
|
|
static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
|
|
void *ptr)
|
|
{
|
|
struct net_device *dev;
|
|
struct hsr_port *port, *master;
|
|
struct hsr_priv *hsr;
|
|
int mtu_max;
|
|
int res;
|
|
|
|
dev = netdev_notifier_info_to_dev(ptr);
|
|
port = hsr_port_get_rtnl(dev);
|
|
if (!port) {
|
|
if (!is_hsr_master(dev))
|
|
return NOTIFY_DONE; /* Not an HSR device */
|
|
hsr = netdev_priv(dev);
|
|
port = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
|
|
if (!port) {
|
|
/* Resend of notification concerning removed device? */
|
|
return NOTIFY_DONE;
|
|
}
|
|
} else {
|
|
hsr = port->hsr;
|
|
}
|
|
|
|
switch (event) {
|
|
case NETDEV_UP: /* Administrative state DOWN */
|
|
case NETDEV_DOWN: /* Administrative state UP */
|
|
case NETDEV_CHANGE: /* Link (carrier) state changes */
|
|
hsr_check_carrier_and_operstate(hsr);
|
|
break;
|
|
case NETDEV_CHANGENAME:
|
|
hsr_debugfs_rename(dev);
|
|
break;
|
|
case NETDEV_CHANGEADDR:
|
|
if (port->type == HSR_PT_MASTER) {
|
|
/* This should not happen since there's no
|
|
* ndo_set_mac_address() for HSR devices - i.e. not
|
|
* supported.
|
|
*/
|
|
break;
|
|
}
|
|
|
|
master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
|
|
|
|
if (port->type == HSR_PT_SLAVE_A) {
|
|
ether_addr_copy(master->dev->dev_addr, dev->dev_addr);
|
|
call_netdevice_notifiers(NETDEV_CHANGEADDR,
|
|
master->dev);
|
|
}
|
|
|
|
/* Make sure we recognize frames from ourselves in hsr_rcv() */
|
|
port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B);
|
|
res = hsr_create_self_node(hsr,
|
|
master->dev->dev_addr,
|
|
port ?
|
|
port->dev->dev_addr :
|
|
master->dev->dev_addr);
|
|
if (res)
|
|
netdev_warn(master->dev,
|
|
"Could not update HSR node address.\n");
|
|
break;
|
|
case NETDEV_CHANGEMTU:
|
|
if (port->type == HSR_PT_MASTER)
|
|
break; /* Handled in ndo_change_mtu() */
|
|
mtu_max = hsr_get_max_mtu(port->hsr);
|
|
master = hsr_port_get_hsr(port->hsr, HSR_PT_MASTER);
|
|
master->dev->mtu = mtu_max;
|
|
break;
|
|
case NETDEV_UNREGISTER:
|
|
hsr_del_port(port);
|
|
break;
|
|
case NETDEV_PRE_TYPE_CHANGE:
|
|
/* HSR works only on Ethernet devices. Refuse slave to change
|
|
* its type.
|
|
*/
|
|
return NOTIFY_BAD;
|
|
}
|
|
|
|
return NOTIFY_DONE;
|
|
}
|
|
|
|
struct hsr_port *hsr_port_get_hsr(struct hsr_priv *hsr, enum hsr_port_type pt)
|
|
{
|
|
struct hsr_port *port;
|
|
|
|
hsr_for_each_port(hsr, port)
|
|
if (port->type == pt)
|
|
return port;
|
|
return NULL;
|
|
}
|
|
|
|
static struct notifier_block hsr_nb = {
|
|
.notifier_call = hsr_netdev_notify, /* Slave event notifications */
|
|
};
|
|
|
|
static int __init hsr_init(void)
|
|
{
|
|
int res;
|
|
|
|
BUILD_BUG_ON(sizeof(struct hsr_tag) != HSR_HLEN);
|
|
|
|
register_netdevice_notifier(&hsr_nb);
|
|
res = hsr_netlink_init();
|
|
|
|
return res;
|
|
}
|
|
|
|
static void __exit hsr_exit(void)
|
|
{
|
|
unregister_netdevice_notifier(&hsr_nb);
|
|
hsr_netlink_exit();
|
|
hsr_debugfs_remove_root();
|
|
}
|
|
|
|
module_init(hsr_init);
|
|
module_exit(hsr_exit);
|
|
MODULE_LICENSE("GPL");
|