linux_dsm_epyc7002/drivers/net
Petar Penkov c39e342a05 tun: fix data-race in gro_normal_list()
There is a race in the TUN driver between napi_busy_loop and
napi_gro_frags. This commit resolves the race by adding the NAPI struct
via netif_tx_napi_add, instead of netif_napi_add, which disables polling
for the NAPI struct.

KCSAN reported:
BUG: KCSAN: data-race in gro_normal_list.part.0 / napi_busy_loop

write to 0xffff8880b5d474b0 of 4 bytes by task 11205 on cpu 0:
 gro_normal_list.part.0+0x77/0xb0 net/core/dev.c:5682
 gro_normal_list net/core/dev.c:5678 [inline]
 gro_normal_one net/core/dev.c:5692 [inline]
 napi_frags_finish net/core/dev.c:5705 [inline]
 napi_gro_frags+0x625/0x770 net/core/dev.c:5778
 tun_get_user+0x2150/0x26a0 drivers/net/tun.c:1976
 tun_chr_write_iter+0x79/0xd0 drivers/net/tun.c:2022
 call_write_iter include/linux/fs.h:1895 [inline]
 do_iter_readv_writev+0x487/0x5b0 fs/read_write.c:693
 do_iter_write fs/read_write.c:970 [inline]
 do_iter_write+0x13b/0x3c0 fs/read_write.c:951
 vfs_writev+0x118/0x1c0 fs/read_write.c:1015
 do_writev+0xe3/0x250 fs/read_write.c:1058
 __do_sys_writev fs/read_write.c:1131 [inline]
 __se_sys_writev fs/read_write.c:1128 [inline]
 __x64_sys_writev+0x4e/0x60 fs/read_write.c:1128
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8880b5d474b0 of 4 bytes by task 11168 on cpu 1:
 gro_normal_list net/core/dev.c:5678 [inline]
 napi_busy_loop+0xda/0x4f0 net/core/dev.c:6126
 sk_busy_loop include/net/busy_poll.h:108 [inline]
 __skb_recv_udp+0x4ad/0x560 net/ipv4/udp.c:1689
 udpv6_recvmsg+0x29e/0xe90 net/ipv6/udp.c:288
 inet6_recvmsg+0xbb/0x240 net/ipv6/af_inet6.c:592
 sock_recvmsg_nosec net/socket.c:871 [inline]
 sock_recvmsg net/socket.c:889 [inline]
 sock_recvmsg+0x92/0xb0 net/socket.c:885
 sock_read_iter+0x15f/0x1e0 net/socket.c:967
 call_read_iter include/linux/fs.h:1889 [inline]
 new_sync_read+0x389/0x4f0 fs/read_write.c:414
 __vfs_read+0xb1/0xc0 fs/read_write.c:427
 vfs_read fs/read_write.c:461 [inline]
 vfs_read+0x143/0x2c0 fs/read_write.c:446
 ksys_read+0xd5/0x1b0 fs/read_write.c:587
 __do_sys_read fs/read_write.c:597 [inline]
 __se_sys_read fs/read_write.c:595 [inline]
 __x64_sys_read+0x4c/0x60 fs/read_write.c:595
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 11168 Comm: syz-executor.0 Not tainted 5.4.0-rc6+ 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 943170998b ("tun: enable NAPI for TUN/TAP driver")
Signed-off-by: Petar Penkov <ppenkov@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-15 12:46:49 -08:00
..
appletalk
arcnet
bonding Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-09 11:04:37 -08:00
caif
can can: flexcan: flexcan_mailbox_read() make use of flexcan_write64() to mark the mailbox as read 2019-11-11 21:58:12 +01:00
dsa net: dsa: ocelot: add driver for Felix switch family 2019-11-15 12:32:16 -08:00
ethernet net: mscc: ocelot: publish ocelot_sys.h to include/soc/mscc 2019-11-15 12:32:16 -08:00
fddi
fjes fjes: Handle workqueue allocation failure 2019-10-29 10:33:10 -07:00
hamradio net: core: add generic lockdep keys 2019-10-24 14:53:48 -07:00
hippi
hyperv hv_netvsc: record hardware hash in skb 2019-11-05 14:01:35 -08:00
ieee802154 Merge tag 'ieee802154-for-davem-2019-11-13' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next 2019-11-13 12:12:34 -08:00
ipvlan Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-02 13:54:56 -07:00
netdevsim netdevsim: Update dummy reporter's devlink binary interface 2019-11-12 11:25:44 -08:00
phy net: phy: dp83869: Add TI dp83869 phy 2019-11-14 17:42:43 -08:00
plip
ppp net: core: add generic lockdep keys 2019-10-24 14:53:48 -07:00
slip
team Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-02 13:54:56 -07:00
usb Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-09 11:04:37 -08:00
vmxnet3
wan
wimax Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-11-02 13:54:56 -07:00
wireless Some relatively small changes: 2019-11-08 11:36:48 -08:00
xen-netback xen/netback: cleanup init and deinit code 2019-10-22 09:52:04 -07:00
dummy.c net: dummy: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
eql.c
geneve.c
gtp.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c net: use u64_stats_t in struct pcpu_lstats 2019-11-07 20:03:08 -08:00
macsec.c net: remove unnecessary variables and callback 2019-10-24 14:53:49 -07:00
macvlan.c net: remove unnecessary variables and callback 2019-10-24 14:53:49 -07:00
macvtap.c
Makefile
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c net: nlmon: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c tun: fix data-race in gro_normal_list() 2019-11-15 12:46:49 -08:00
veth.c veth: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
virtio_net.c
vrf.c net: core: add generic lockdep keys 2019-10-24 14:53:48 -07:00
vsockmon.c vsockmon: use standard dev_lstats_add() and dev_lstats_read() 2019-11-07 20:03:08 -08:00
vxlan.c vxlan: implement get_link_ksettings ethtool method 2019-11-12 19:52:15 -08:00
xen-netfront.c