queue-6.6/net-sched-fix-lockdep-splat-in-qdisc_tree_reduce_backlog.patch

   1 From 7eb322360b0266481e560d1807ee79e0cef5742b Mon Sep 17 00:00:00 2001
   2 From: Eric Dumazet <edumazet@google.com>
   3 Date: Tue, 2 Apr 2024 13:41:33 +0000
   4 Subject: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
   5
   6 From: Eric Dumazet <edumazet@google.com>
   7
   8 commit 7eb322360b0266481e560d1807ee79e0cef5742b upstream.
   9
  10 qdisc_tree_reduce_backlog() is called with the qdisc lock held,
  11 not RTNL.
  12
  13 We must use qdisc_lookup_rcu() instead of qdisc_lookup()
  14
  15 syzbot reported:
  16
  17 WARNING: suspicious RCU usage
  18 6.1.74-syzkaller #0 Not tainted
  19 -----------------------------
  20 net/sched/sch_api.c:305 suspicious rcu_dereference_protected() usage!
  21
  22 other info that might help us debug this:
  23
  24 rcu_scheduler_active = 2, debug_locks = 1
  25 3 locks held by udevd/1142:
  26   #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline]
  27   #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
  28   #0: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: net_tx_action+0x64a/0x970 net/core/dev.c:5282
  29   #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline]
  30   #1: ffff888171861108 (&sch->q.lock){+.-.}-{2:2}, at: net_tx_action+0x754/0x970 net/core/dev.c:5297
  31   #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:306 [inline]
  32   #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:747 [inline]
  33   #2: ffffffff87c729a0 (rcu_read_lock){....}-{1:2}, at: qdisc_tree_reduce_backlog+0x84/0x580 net/sched/sch_api.c:792
  34
  35 stack backtrace:
  36 CPU: 1 PID: 1142 Comm: udevd Not tainted 6.1.74-syzkaller #0
  37 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
  38 Call Trace:
  39  <TASK>
  40   [<ffffffff85b85f14>] __dump_stack lib/dump_stack.c:88 [inline]
  41   [<ffffffff85b85f14>] dump_stack_lvl+0x1b1/0x28f lib/dump_stack.c:106
  42   [<ffffffff85b86007>] dump_stack+0x15/0x1e lib/dump_stack.c:113
  43   [<ffffffff81802299>] lockdep_rcu_suspicious+0x1b9/0x260 kernel/locking/lockdep.c:6592
  44   [<ffffffff84f0054c>] qdisc_lookup+0xac/0x6f0 net/sched/sch_api.c:305
  45   [<ffffffff84f037c3>] qdisc_tree_reduce_backlog+0x243/0x580 net/sched/sch_api.c:811
  46   [<ffffffff84f5b78c>] pfifo_tail_enqueue+0x32c/0x4b0 net/sched/sch_fifo.c:51
  47   [<ffffffff84fbcf63>] qdisc_enqueue include/net/sch_generic.h:833 [inline]
  48   [<ffffffff84fbcf63>] netem_dequeue+0xeb3/0x15d0 net/sched/sch_netem.c:723
  49   [<ffffffff84eecab9>] dequeue_skb net/sched/sch_generic.c:292 [inline]
  50   [<ffffffff84eecab9>] qdisc_restart net/sched/sch_generic.c:397 [inline]
  51   [<ffffffff84eecab9>] __qdisc_run+0x249/0x1e60 net/sched/sch_generic.c:415
  52   [<ffffffff84d7aa96>] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125
  53   [<ffffffff84d85d29>] net_tx_action+0x7c9/0x970 net/core/dev.c:5313
  54   [<ffffffff85e002bd>] __do_softirq+0x2bd/0x9bd kernel/softirq.c:616
  55   [<ffffffff81568bca>] invoke_softirq kernel/softirq.c:447 [inline]
  56   [<ffffffff81568bca>] __irq_exit_rcu+0xca/0x230 kernel/softirq.c:700
  57   [<ffffffff81568ae9>] irq_exit_rcu+0x9/0x20 kernel/softirq.c:712
  58   [<ffffffff85b89f52>] sysvec_apic_timer_interrupt+0x42/0x90 arch/x86/kernel/apic/apic.c:1107
  59   [<ffffffff85c00ccb>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:656
  60
  61 Fixes: d636fc5dd692 ("net: sched: add rcu annotations around qdisc->qdisc_sleeping")
  62 Reported-by: syzbot <syzkaller@googlegroups.com>
  63 Signed-off-by: Eric Dumazet <edumazet@google.com>
  64 Reviewed-by: Jiri Pirko <jiri@nvidia.com>
  65 Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
  66 Link: https://lore.kernel.org/r/20240402134133.2352776-1-edumazet@google.com
  67 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  68 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  69 ---
  70  net/sched/sch_api.c |    2 +-
  71  1 file changed, 1 insertion(+), 1 deletion(-)
  72
  73 --- a/net/sched/sch_api.c
  74 +++ b/net/sched/sch_api.c
  75 @@ -809,7 +809,7 @@ void qdisc_tree_reduce_backlog(struct Qd
  76                 notify = !sch->q.qlen && !WARN_ON_ONCE(!n &&
  77                                                        !qdisc_is_offloaded);
  78                 /* TODO: perform the search on a per txq basis */
  79 -               sch = qdisc_lookup(qdisc_dev(sch), TC_H_MAJ(parentid));
  80 +               sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid));
  81                 if (sch == NULL) {
  82                         WARN_ON_ONCE(parentid != TC_H_ROOT);
  83                         break;