Revision ea4fdbaa2f7798cb25adbe4fd52ffc6356f097bb authored by Eric Dumazet on 23 January 2023, 08:45:52 UTC, committed by Jakub Kicinski on 25 January 2023, 02:17:29 UTC
As reported by syzbot and hinted by Vinicius, I should not have added a qdisc_synchronize() call in taprio_reset() taprio_reset() can be called with qdisc spinlock held (and BH disabled) as shown in included syzbot report [1]. Only taprio_destroy() needed this synchronization, as explained in the blamed commit changelog. [1] BUG: scheduling while atomic: syz-executor150/5091/0x00000202 2 locks held by syz-executor150/5091: Modules linked in: Preemption disabled at: [<0000000000000000>] 0x0 Kernel panic - not syncing: scheduling while atomic: panic_on_warn set ... CPU: 1 PID: 5091 Comm: syz-executor150 Not tainted 6.2.0-rc3-syzkaller-00219-g010a74f52203 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 panic+0x2cc/0x626 kernel/panic.c:318 check_panic_on_warn.cold+0x19/0x35 kernel/panic.c:238 __schedule_bug.cold+0xd5/0xfe kernel/sched/core.c:5836 schedule_debug kernel/sched/core.c:5865 [inline] __schedule+0x34e4/0x5450 kernel/sched/core.c:6500 schedule+0xde/0x1b0 kernel/sched/core.c:6682 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167 schedule_timeout_uninterruptible kernel/time/timer.c:2201 [inline] msleep+0xb6/0x100 kernel/time/timer.c:2322 qdisc_synchronize include/net/sch_generic.h:1295 [inline] taprio_reset+0x93/0x270 net/sched/sch_taprio.c:1703 qdisc_reset+0x10c/0x770 net/sched/sch_generic.c:1022 dev_reset_queue+0x92/0x130 net/sched/sch_generic.c:1285 netdev_for_each_tx_queue include/linux/netdevice.h:2464 [inline] dev_deactivate_many+0x36d/0x9f0 net/sched/sch_generic.c:1351 dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1374 qdisc_graft+0xe4a/0x1380 net/sched/sch_api.c:1080 tc_modify_qdisc+0xb6b/0x19a0 net/sched/sch_api.c:1689 rtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6141 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline] Fixes: 3a415d59c1db ("net/sched: sch_taprio: fix possible use-after-free") Link: https://lore.kernel.org/netdev/167387581653.2747.13878941339893288655.git-patchwork-notify@kernel.org/T/ Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Vinicius Costa Gomes <vinicius.gomes@intel.com> Link: https://lore.kernel.org/r/20230123084552.574396-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent d968117
File | Mode | Size |
---|---|---|
asymmetric_keys | ||
async_tx | ||
842.c | -rw-r--r-- | 3.7 KB |
Kconfig | -rw-r--r-- | 37.0 KB |
Makefile | -rw-r--r-- | 8.1 KB |
acompress.c | -rw-r--r-- | 4.7 KB |
adiantum.c | -rw-r--r-- | 19.5 KB |
aead.c | -rw-r--r-- | 7.2 KB |
aegis.h | -rw-r--r-- | 2.5 KB |
aegis128-core.c | -rw-r--r-- | 15.6 KB |
aegis128-neon-inner.c | -rw-r--r-- | 8.4 KB |
aegis128-neon.c | -rw-r--r-- | 2.0 KB |
aes_generic.c | -rw-r--r-- | 57.6 KB |
aes_ti.c | -rw-r--r-- | 2.0 KB |
af_alg.c | -rw-r--r-- | 29.5 KB |
ahash.c | -rw-r--r-- | 15.7 KB |
akcipher.c | -rw-r--r-- | 4.2 KB |
algapi.c | -rw-r--r-- | 30.1 KB |
algboss.c | -rw-r--r-- | 5.3 KB |
algif_aead.c | -rw-r--r-- | 15.6 KB |
algif_hash.c | -rw-r--r-- | 9.5 KB |
algif_rng.c | -rw-r--r-- | 8.4 KB |
algif_skcipher.c | -rw-r--r-- | 9.6 KB |
ansi_cprng.c | -rw-r--r-- | 10.8 KB |
anubis.c | -rw-r--r-- | 27.8 KB |
api.c | -rw-r--r-- | 15.0 KB |
arc4.c | -rw-r--r-- | 2.1 KB |
aria_generic.c | -rw-r--r-- | 7.3 KB |
authenc.c | -rw-r--r-- | 13.1 KB |
authencesn.c | -rw-r--r-- | 14.2 KB |
blake2b_generic.c | -rw-r--r-- | 5.9 KB |
blowfish_common.c | -rw-r--r-- | 15.5 KB |
blowfish_generic.c | -rw-r--r-- | 3.1 KB |
camellia_generic.c | -rw-r--r-- | 34.0 KB |
cast5_generic.c | -rw-r--r-- | 20.4 KB |
cast6_generic.c | -rw-r--r-- | 9.1 KB |
cast_common.c | -rw-r--r-- | 12.9 KB |
cbc.c | -rw-r--r-- | 5.2 KB |
ccm.c | -rw-r--r-- | 23.4 KB |
cfb.c | -rw-r--r-- | 6.2 KB |
chacha20poly1305.c | -rw-r--r-- | 17.7 KB |
chacha_generic.c | -rw-r--r-- | 3.9 KB |
cipher.c | -rw-r--r-- | 2.6 KB |
cmac.c | -rw-r--r-- | 7.6 KB |
compress.c | -rw-r--r-- | 921 bytes |
crc32_generic.c | -rw-r--r-- | 2.8 KB |
crc32c_generic.c | -rw-r--r-- | 4.1 KB |
crc64_rocksoft_generic.c | -rw-r--r-- | 1.9 KB |
crct10dif_common.c | -rw-r--r-- | 3.6 KB |
crct10dif_generic.c | -rw-r--r-- | 3.1 KB |
cryptd.c | -rw-r--r-- | 28.5 KB |
crypto_engine.c | -rw-r--r-- | 16.2 KB |
crypto_null.c | -rw-r--r-- | 5.3 KB |
crypto_user_base.c | -rw-r--r-- | 12.0 KB |
crypto_user_stat.c | -rw-r--r-- | 9.6 KB |
ctr.c | -rw-r--r-- | 9.6 KB |
cts.c | -rw-r--r-- | 11.5 KB |
curve25519-generic.c | -rw-r--r-- | 2.2 KB |
deflate.c | -rw-r--r-- | 7.7 KB |
des_generic.c | -rw-r--r-- | 3.3 KB |
dh.c | -rw-r--r-- | 29.1 KB |
dh_helper.c | -rw-r--r-- | 3.2 KB |
drbg.c | -rw-r--r-- | 60.3 KB |
ecb.c | -rw-r--r-- | 2.4 KB |
ecc.c | -rw-r--r-- | 42.1 KB |
ecc_curve_defs.h | -rw-r--r-- | 3.7 KB |
ecdh.c | -rw-r--r-- | 5.7 KB |
ecdh_helper.c | -rw-r--r-- | 2.0 KB |
ecdsa.c | -rw-r--r-- | 9.2 KB |
ecdsasignature.asn1 | -rw-r--r-- | 111 bytes |
echainiv.c | -rw-r--r-- | 4.1 KB |
ecrdsa.c | -rw-r--r-- | 8.4 KB |
ecrdsa_defs.h | -rw-r--r-- | 7.2 KB |
ecrdsa_params.asn1 | -rw-r--r-- | 142 bytes |
ecrdsa_pub_key.asn1 | -rw-r--r-- | 57 bytes |
essiv.c | -rw-r--r-- | 17.9 KB |
fcrypt.c | -rw-r--r-- | 18.0 KB |
fips.c | -rw-r--r-- | 2.2 KB |
gcm.c | -rw-r--r-- | 30.0 KB |
geniv.c | -rw-r--r-- | 3.8 KB |
ghash-generic.c | -rw-r--r-- | 4.8 KB |
hash_info.c | -rw-r--r-- | 1.9 KB |
hctr2.c | -rw-r--r-- | 16.7 KB |
hmac.c | -rw-r--r-- | 6.5 KB |
internal.h | -rw-r--r-- | 4.7 KB |
jitterentropy-kcapi.c | -rw-r--r-- | 6.1 KB |
jitterentropy.c | -rw-r--r-- | 25.9 KB |
jitterentropy.h | -rw-r--r-- | 607 bytes |
kdf_sp800108.c | -rw-r--r-- | 3.7 KB |
keywrap.c | -rw-r--r-- | 9.5 KB |
khazad.c | -rw-r--r-- | 51.8 KB |
kpp.c | -rw-r--r-- | 3.6 KB |
lrw.c | -rw-r--r-- | 10.6 KB |
lz4.c | -rw-r--r-- | 3.3 KB |
lz4hc.c | -rw-r--r-- | 3.4 KB |
lzo-rle.c | -rw-r--r-- | 3.4 KB |
lzo.c | -rw-r--r-- | 3.3 KB |
md4.c | -rw-r--r-- | 5.9 KB |
md5.c | -rw-r--r-- | 7.4 KB |
michael_mic.c | -rw-r--r-- | 3.4 KB |
nhpoly1305.c | -rw-r--r-- | 7.8 KB |
ofb.c | -rw-r--r-- | 2.5 KB |
pcbc.c | -rw-r--r-- | 4.7 KB |
pcrypt.c | -rw-r--r-- | 9.2 KB |
poly1305_generic.c | -rw-r--r-- | 3.7 KB |
polyval-generic.c | -rw-r--r-- | 6.6 KB |
proc.c | -rw-r--r-- | 2.5 KB |
ripemd.h | -rw-r--r-- | 655 bytes |
rmd160.c | -rw-r--r-- | 12.4 KB |
rng.c | -rw-r--r-- | 4.7 KB |
rsa-pkcs1pad.c | -rw-r--r-- | 17.6 KB |
rsa.c | -rw-r--r-- | 6.8 KB |
rsa_helper.c | -rw-r--r-- | 4.0 KB |
rsaprivkey.asn1 | -rw-r--r-- | 316 bytes |
rsapubkey.asn1 | -rw-r--r-- | 82 bytes |
scatterwalk.c | -rw-r--r-- | 2.0 KB |
scompress.c | -rw-r--r-- | 6.8 KB |
seed.c | -rw-r--r-- | 17.2 KB |
seqiv.c | -rw-r--r-- | 4.5 KB |
serpent_generic.c | -rw-r--r-- | 19.6 KB |
sha1_generic.c | -rw-r--r-- | 2.3 KB |
sha256_generic.c | -rw-r--r-- | 3.1 KB |
sha3_generic.c | -rw-r--r-- | 8.0 KB |
sha512_generic.c | -rw-r--r-- | 7.7 KB |
shash.c | -rw-r--r-- | 15.4 KB |
simd.c | -rw-r--r-- | 13.5 KB |
skcipher.c | -rw-r--r-- | 24.8 KB |
sm2.c | -rw-r--r-- | 9.7 KB |
sm2signature.asn1 | -rw-r--r-- | 113 bytes |
sm3.c | -rw-r--r-- | 7.8 KB |
sm3_generic.c | -rw-r--r-- | 2.1 KB |
sm4.c | -rw-r--r-- | 5.6 KB |
sm4_generic.c | -rw-r--r-- | 2.1 KB |
streebog_generic.c | -rw-r--r-- | 57.6 KB |
tcrypt.c | -rw-r--r-- | 77.6 KB |
tcrypt.h | -rw-r--r-- | 3.0 KB |
tea.c | -rw-r--r-- | 6.5 KB |
testmgr.c | -rw-r--r-- | 150.2 KB |
testmgr.h | -rw-r--r-- | 1.5 MB |
twofish_common.c | -rw-r--r-- | 37.1 KB |
twofish_generic.c | -rw-r--r-- | 5.5 KB |
vmac.c | -rw-r--r-- | 18.9 KB |
wp512.c | -rw-r--r-- | 59.7 KB |
xcbc.c | -rw-r--r-- | 6.7 KB |
xctr.c | -rw-r--r-- | 5.3 KB |
xor.c | -rw-r--r-- | 3.8 KB |
xts.c | -rw-r--r-- | 11.8 KB |
xxhash_generic.c | -rw-r--r-- | 2.4 KB |
zstd.c | -rw-r--r-- | 5.0 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...