Revision 4e43e64d0f1332fcc503babad4dc31aead7131ca authored by Eric Dumazet on 28 June 2022, 12:12:48 UTC, committed by Jakub Kicinski on 30 June 2022, 03:41:09 UTC
As reported by syzbot, we should not use rcu_dereference() when rcu_read_lock() is not held. WARNING: suspicious RCU usage 5.19.0-rc2-syzkaller #0 Not tainted net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz-executor326/3617: #0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223 stack backtrace: CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175 inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300 netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275 __netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380 netlink_dump_start include/linux/netlink.h:245 [inline] rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Taehee Yoo <ap420073@gmail.com> Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent fa152f6
tb0219.c
// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Driver for TANBAC TB0219 base board.
*
* Copyright (C) 2005 Yoichi Yuasa <yuasa@linux-mips.org>
*/
#include <linux/platform_device.h>
#include <linux/fs.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/uaccess.h>
#include <asm/io.h>
#include <asm/reboot.h>
#include <asm/vr41xx/giu.h>
#include <asm/vr41xx/tb0219.h>
MODULE_AUTHOR("Yoichi Yuasa <yuasa@linux-mips.org>");
MODULE_DESCRIPTION("TANBAC TB0219 base board driver");
MODULE_LICENSE("GPL");
static int major; /* default is dynamic major device number */
module_param(major, int, 0);
MODULE_PARM_DESC(major, "Major device number");
static void (*old_machine_restart)(char *command);
static void __iomem *tb0219_base;
static DEFINE_SPINLOCK(tb0219_lock);
#define tb0219_read(offset) readw(tb0219_base + (offset))
#define tb0219_write(offset, value) writew((value), tb0219_base + (offset))
#define TB0219_START 0x0a000000UL
#define TB0219_SIZE 0x20UL
#define TB0219_LED 0x00
#define TB0219_GPIO_INPUT 0x02
#define TB0219_GPIO_OUTPUT 0x04
#define TB0219_DIP_SWITCH 0x06
#define TB0219_MISC 0x08
#define TB0219_RESET 0x0e
#define TB0219_PCI_SLOT1_IRQ_STATUS 0x10
#define TB0219_PCI_SLOT2_IRQ_STATUS 0x12
#define TB0219_PCI_SLOT3_IRQ_STATUS 0x14
typedef enum {
TYPE_LED,
TYPE_GPIO_OUTPUT,
} tb0219_type_t;
/*
* Minor device number
* 0 = 7 segment LED
*
* 16 = GPIO IN 0
* 17 = GPIO IN 1
* 18 = GPIO IN 2
* 19 = GPIO IN 3
* 20 = GPIO IN 4
* 21 = GPIO IN 5
* 22 = GPIO IN 6
* 23 = GPIO IN 7
*
* 32 = GPIO OUT 0
* 33 = GPIO OUT 1
* 34 = GPIO OUT 2
* 35 = GPIO OUT 3
* 36 = GPIO OUT 4
* 37 = GPIO OUT 5
* 38 = GPIO OUT 6
* 39 = GPIO OUT 7
*
* 48 = DIP switch 1
* 49 = DIP switch 2
* 50 = DIP switch 3
* 51 = DIP switch 4
* 52 = DIP switch 5
* 53 = DIP switch 6
* 54 = DIP switch 7
* 55 = DIP switch 8
*/
static inline char get_led(void)
{
return (char)tb0219_read(TB0219_LED);
}
static inline char get_gpio_input_pin(unsigned int pin)
{
uint16_t values;
values = tb0219_read(TB0219_GPIO_INPUT);
if (values & (1 << pin))
return '1';
return '0';
}
static inline char get_gpio_output_pin(unsigned int pin)
{
uint16_t values;
values = tb0219_read(TB0219_GPIO_OUTPUT);
if (values & (1 << pin))
return '1';
return '0';
}
static inline char get_dip_switch(unsigned int pin)
{
uint16_t values;
values = tb0219_read(TB0219_DIP_SWITCH);
if (values & (1 << pin))
return '1';
return '0';
}
static inline int set_led(char command)
{
tb0219_write(TB0219_LED, command);
return 0;
}
static inline int set_gpio_output_pin(unsigned int pin, char command)
{
unsigned long flags;
uint16_t value;
if (command != '0' && command != '1')
return -EINVAL;
spin_lock_irqsave(&tb0219_lock, flags);
value = tb0219_read(TB0219_GPIO_OUTPUT);
if (command == '0')
value &= ~(1 << pin);
else
value |= 1 << pin;
tb0219_write(TB0219_GPIO_OUTPUT, value);
spin_unlock_irqrestore(&tb0219_lock, flags);
return 0;
}
static ssize_t tanbac_tb0219_read(struct file *file, char __user *buf, size_t len,
loff_t *ppos)
{
unsigned int minor;
char value;
minor = iminor(file_inode(file));
switch (minor) {
case 0:
value = get_led();
break;
case 16 ... 23:
value = get_gpio_input_pin(minor - 16);
break;
case 32 ... 39:
value = get_gpio_output_pin(minor - 32);
break;
case 48 ... 55:
value = get_dip_switch(minor - 48);
break;
default:
return -EBADF;
}
if (len <= 0)
return -EFAULT;
if (put_user(value, buf))
return -EFAULT;
return 1;
}
static ssize_t tanbac_tb0219_write(struct file *file, const char __user *data,
size_t len, loff_t *ppos)
{
unsigned int minor;
tb0219_type_t type;
size_t i;
int retval = 0;
char c;
minor = iminor(file_inode(file));
switch (minor) {
case 0:
type = TYPE_LED;
break;
case 32 ... 39:
type = TYPE_GPIO_OUTPUT;
break;
default:
return -EBADF;
}
for (i = 0; i < len; i++) {
if (get_user(c, data + i))
return -EFAULT;
switch (type) {
case TYPE_LED:
retval = set_led(c);
break;
case TYPE_GPIO_OUTPUT:
retval = set_gpio_output_pin(minor - 32, c);
break;
}
if (retval < 0)
break;
}
return i;
}
static int tanbac_tb0219_open(struct inode *inode, struct file *file)
{
unsigned int minor;
minor = iminor(inode);
switch (minor) {
case 0:
case 16 ... 23:
case 32 ... 39:
case 48 ... 55:
return stream_open(inode, file);
default:
break;
}
return -EBADF;
}
static int tanbac_tb0219_release(struct inode *inode, struct file *file)
{
return 0;
}
static const struct file_operations tb0219_fops = {
.owner = THIS_MODULE,
.read = tanbac_tb0219_read,
.write = tanbac_tb0219_write,
.open = tanbac_tb0219_open,
.release = tanbac_tb0219_release,
.llseek = no_llseek,
};
static void tb0219_restart(char *command)
{
tb0219_write(TB0219_RESET, 0);
}
static void tb0219_pci_irq_init(void)
{
/* PCI Slot 1 */
vr41xx_set_irq_trigger(TB0219_PCI_SLOT1_PIN, IRQ_TRIGGER_LEVEL, IRQ_SIGNAL_THROUGH);
vr41xx_set_irq_level(TB0219_PCI_SLOT1_PIN, IRQ_LEVEL_LOW);
/* PCI Slot 2 */
vr41xx_set_irq_trigger(TB0219_PCI_SLOT2_PIN, IRQ_TRIGGER_LEVEL, IRQ_SIGNAL_THROUGH);
vr41xx_set_irq_level(TB0219_PCI_SLOT2_PIN, IRQ_LEVEL_LOW);
/* PCI Slot 3 */
vr41xx_set_irq_trigger(TB0219_PCI_SLOT3_PIN, IRQ_TRIGGER_LEVEL, IRQ_SIGNAL_THROUGH);
vr41xx_set_irq_level(TB0219_PCI_SLOT3_PIN, IRQ_LEVEL_LOW);
}
static int tb0219_probe(struct platform_device *dev)
{
int retval;
if (request_mem_region(TB0219_START, TB0219_SIZE, "TB0219") == NULL)
return -EBUSY;
tb0219_base = ioremap(TB0219_START, TB0219_SIZE);
if (tb0219_base == NULL) {
release_mem_region(TB0219_START, TB0219_SIZE);
return -ENOMEM;
}
retval = register_chrdev(major, "TB0219", &tb0219_fops);
if (retval < 0) {
iounmap(tb0219_base);
tb0219_base = NULL;
release_mem_region(TB0219_START, TB0219_SIZE);
return retval;
}
old_machine_restart = _machine_restart;
_machine_restart = tb0219_restart;
tb0219_pci_irq_init();
if (major == 0) {
major = retval;
printk(KERN_INFO "TB0219: major number %d\n", major);
}
return 0;
}
static int tb0219_remove(struct platform_device *dev)
{
_machine_restart = old_machine_restart;
iounmap(tb0219_base);
tb0219_base = NULL;
release_mem_region(TB0219_START, TB0219_SIZE);
return 0;
}
static struct platform_device *tb0219_platform_device;
static struct platform_driver tb0219_device_driver = {
.probe = tb0219_probe,
.remove = tb0219_remove,
.driver = {
.name = "TB0219",
},
};
static int __init tanbac_tb0219_init(void)
{
int retval;
tb0219_platform_device = platform_device_alloc("TB0219", -1);
if (!tb0219_platform_device)
return -ENOMEM;
retval = platform_device_add(tb0219_platform_device);
if (retval < 0) {
platform_device_put(tb0219_platform_device);
return retval;
}
retval = platform_driver_register(&tb0219_device_driver);
if (retval < 0)
platform_device_unregister(tb0219_platform_device);
return retval;
}
static void __exit tanbac_tb0219_exit(void)
{
platform_driver_unregister(&tb0219_device_driver);
platform_device_unregister(tb0219_platform_device);
}
module_init(tanbac_tb0219_init);
module_exit(tanbac_tb0219_exit);
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...