releases/4.2.7/ipmr-fix-possible-race-resulting-from-improper-usage-of-ip_inc_stats_bh-in-preemptible-context.patch

   1 From foo@baz Tue Nov 17 14:34:38 PST 2015
   2 From: Ani Sinha <ani@arista.com>
   3 Date: Fri, 30 Oct 2015 16:54:31 -0700
   4 Subject: ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context.
   5
   6 From: Ani Sinha <ani@arista.com>
   7
   8 [ Upstream commit 44f49dd8b5a606870a1f21101522a0f9c4414784 ]
   9
  10 Fixes the following kernel BUG :
  11
  12 BUG: using __this_cpu_add() in preemptible [00000000] code: bash/2758
  13 caller is __this_cpu_preempt_check+0x13/0x15
  14 CPU: 0 PID: 2758 Comm: bash Tainted: P           O   3.18.19 #2
  15  ffffffff8170eaca ffff880110d1b788 ffffffff81482b2a 0000000000000000
  16  0000000000000000 ffff880110d1b7b8 ffffffff812010ae ffff880007cab800
  17  ffff88001a060800 ffff88013a899108 ffff880108b84240 ffff880110d1b7c8
  18 Call Trace:
  19 [<ffffffff81482b2a>] dump_stack+0x52/0x80
  20 [<ffffffff812010ae>] check_preemption_disabled+0xce/0xe1
  21 [<ffffffff812010d4>] __this_cpu_preempt_check+0x13/0x15
  22 [<ffffffff81419d60>] ipmr_queue_xmit+0x647/0x70c
  23 [<ffffffff8141a154>] ip_mr_forward+0x32f/0x34e
  24 [<ffffffff8141af76>] ip_mroute_setsockopt+0xe03/0x108c
  25 [<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
  26 [<ffffffff810e6974>] ? pollwake+0x4d/0x51
  27 [<ffffffff81058ac0>] ? default_wake_function+0x0/0xf
  28 [<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
  29 [<ffffffff810613d9>] ? __wake_up_common+0x45/0x77
  30 [<ffffffff81486ea9>] ? _raw_spin_unlock_irqrestore+0x1d/0x32
  31 [<ffffffff810618bc>] ? __wake_up_sync_key+0x4a/0x53
  32 [<ffffffff8139a519>] ? sock_def_readable+0x71/0x75
  33 [<ffffffff813dd226>] do_ip_setsockopt+0x9d/0xb55
  34 [<ffffffff81429818>] ? unix_seqpacket_sendmsg+0x3f/0x41
  35 [<ffffffff813963fe>] ? sock_sendmsg+0x6d/0x86
  36 [<ffffffff813959d4>] ? sockfd_lookup_light+0x12/0x5d
  37 [<ffffffff8139650a>] ? SyS_sendto+0xf3/0x11b
  38 [<ffffffff810d5738>] ? new_sync_read+0x82/0xaa
  39 [<ffffffff813ddd19>] compat_ip_setsockopt+0x3b/0x99
  40 [<ffffffff813fb24a>] compat_raw_setsockopt+0x11/0x32
  41 [<ffffffff81399052>] compat_sock_common_setsockopt+0x18/0x1f
  42 [<ffffffff813c4d05>] compat_SyS_setsockopt+0x1a9/0x1cf
  43 [<ffffffff813c4149>] compat_SyS_socketcall+0x180/0x1e3
  44 [<ffffffff81488ea1>] cstar_dispatch+0x7/0x1e
  45
  46 Signed-off-by: Ani Sinha <ani@arista.com>
  47 Acked-by: Eric Dumazet <edumazet@google.com>
  48 Signed-off-by: David S. Miller <davem@davemloft.net>
  49 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  50 ---
  51  net/ipv4/ipmr.c |    6 +++---
  52  1 file changed, 3 insertions(+), 3 deletions(-)
  53
  54 --- a/net/ipv4/ipmr.c
  55 +++ b/net/ipv4/ipmr.c
  56 @@ -1683,8 +1683,8 @@ static inline int ipmr_forward_finish(st
  57  {
  58         struct ip_options *opt = &(IPCB(skb)->opt);
  59
  60 -       IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
  61 -       IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
  62 +       IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
  63 +       IP_ADD_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
  64
  65         if (unlikely(opt->optlen))
  66                 ip_forward_options(skb);
  67 @@ -1746,7 +1746,7 @@ static void ipmr_queue_xmit(struct net *
  68                  * to blackhole.
  69                  */
  70
  71 -               IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
  72 +               IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
  73                 ip_rt_put(rt);
  74                 goto out_free;
  75         }