All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning
@ 2024-06-09 10:36 Nikolay Aleksandrov
  2024-06-09 10:36 ` [PATCH net 1/2] net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state Nikolay Aleksandrov
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Nikolay Aleksandrov @ 2024-06-09 10:36 UTC (permalink / raw)
  To: netdev
  Cc: tobias, kuba, roopa, bridge, edumazet, pabeni, horms,
	Nikolay Aleksandrov

Hi all,
This set fixes a suspicious RCU usage warning triggered by syzbot[1] in
the bridge's MST code. After I converted br_mst_set_state to RCU, I
forgot to update the vlan group dereference helper. Fix it by using
the proper helper, in order to do that we need to pass the vlan group
which is already obtained correctly by the callers for their respective
context. Patch 01 is a requirement for the fix in patch 02.

Note I did consider rcu_dereference_rtnl() but the churn is much bigger
and in every part of the bridge. We can do that as a cleanup in
net-next.

Cheers,
 Nik

[1] https://syzkaller.appspot.com/bug?extid=9bbe2de1bc9d470eb5fe
 =============================
 WARNING: suspicious RCU usage
 6.10.0-rc2-syzkaller-00235-g8a92980606e3 #0 Not tainted
 -----------------------------
 net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!

 other info that might help us debug this:

 rcu_scheduler_active = 2, debug_locks = 1
 4 locks held by syz-executor.1/5374:
  #0: ffff888022d50b18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock include/linux/mmap_lock.h:144 [inline]
  #0: ffff888022d50b18 (&mm->mmap_lock){++++}-{3:3}, at: __mm_populate+0x1b0/0x460 mm/gup.c:2111
  #1: ffffc90000a18c00 ((&p->forward_delay_timer)){+.-.}-{0:0}, at: call_timer_fn+0xc0/0x650 kernel/time/timer.c:1789
  #2: ffff88805fb2ccb8 (&br->lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
  #2: ffff88805fb2ccb8 (&br->lock){+.-.}-{2:2}, at: br_forward_delay_timer_expired+0x50/0x440 net/bridge/br_stp_timer.c:86
  #3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]
  #3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline]
  #3: ffffffff8e333fa0 (rcu_read_lock){....}-{1:2}, at: br_mst_set_state+0x171/0x7a0 net/bridge/br_mst.c:105

 stack backtrace:
 CPU: 1 PID: 5374 Comm: syz-executor.1 Not tainted 6.10.0-rc2-syzkaller-00235-g8a92980606e3 #0
 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
 Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712
  nbp_vlan_group net/bridge/br_private.h:1599 [inline]
  br_mst_set_state+0x29e/0x7a0 net/bridge/br_mst.c:106
  br_set_state+0x28a/0x7b0 net/bridge/br_stp.c:47
  br_forward_delay_timer_expired+0x176/0x440 net/bridge/br_stp_timer.c:88
  call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
  expire_timers kernel/time/timer.c:1843 [inline]
  __run_timers kernel/time/timer.c:2417 [inline]
  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
  run_timer_base kernel/time/timer.c:2437 [inline]
  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
  handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
  __do_softirq kernel/softirq.c:588 [inline]
  invoke_softirq kernel/softirq.c:428 [inline]
  __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
  irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
  </IRQ>
  <TASK>

Nikolay Aleksandrov (2):
  net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
  net: bridge: mst: fix suspicious rcu usage in br_mst_set_state

 net/bridge/br_mst.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

-- 
2.45.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH net 1/2] net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
  2024-06-09 10:36 [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning Nikolay Aleksandrov
@ 2024-06-09 10:36 ` Nikolay Aleksandrov
  2024-06-09 10:36 ` [PATCH net 2/2] net: bridge: mst: fix suspicious rcu usage in br_mst_set_state Nikolay Aleksandrov
  2024-06-13  2:00 ` [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning patchwork-bot+netdevbpf
  2 siblings, 0 replies; 4+ messages in thread
From: Nikolay Aleksandrov @ 2024-06-09 10:36 UTC (permalink / raw)
  To: netdev
  Cc: tobias, kuba, roopa, bridge, edumazet, pabeni, horms,
	Nikolay Aleksandrov, syzbot+9bbe2de1bc9d470eb5fe

Pass the already obtained vlan group pointer to br_mst_vlan_set_state()
instead of dereferencing it again. Each caller has already correctly
dereferenced it for their context. This change is required for the
following suspicious RCU dereference fix. No functional changes
intended.

Fixes: 3a7c1661ae13 ("net: bridge: mst: fix vlan use-after-free")
Reported-by: syzbot+9bbe2de1bc9d470eb5fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bbe2de1bc9d470eb5fe
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
---
 net/bridge/br_mst.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c
index 3c66141d34d6..1de72816b0fb 100644
--- a/net/bridge/br_mst.c
+++ b/net/bridge/br_mst.c
@@ -73,11 +73,10 @@ int br_mst_get_state(const struct net_device *dev, u16 msti, u8 *state)
 }
 EXPORT_SYMBOL_GPL(br_mst_get_state);
 
-static void br_mst_vlan_set_state(struct net_bridge_port *p, struct net_bridge_vlan *v,
+static void br_mst_vlan_set_state(struct net_bridge_vlan_group *vg,
+				  struct net_bridge_vlan *v,
 				  u8 state)
 {
-	struct net_bridge_vlan_group *vg = nbp_vlan_group(p);
-
 	if (br_vlan_get_state(v) == state)
 		return;
 
@@ -121,7 +120,7 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state,
 		if (v->brvlan->msti != msti)
 			continue;
 
-		br_mst_vlan_set_state(p, v, state);
+		br_mst_vlan_set_state(vg, v, state);
 	}
 
 out:
@@ -140,13 +139,13 @@ static void br_mst_vlan_sync_state(struct net_bridge_vlan *pv, u16 msti)
 		 * it.
 		 */
 		if (v != pv && v->brvlan->msti == msti) {
-			br_mst_vlan_set_state(pv->port, pv, v->state);
+			br_mst_vlan_set_state(vg, pv, v->state);
 			return;
 		}
 	}
 
 	/* Otherwise, start out in a new MSTI with all ports disabled. */
-	return br_mst_vlan_set_state(pv->port, pv, BR_STATE_DISABLED);
+	return br_mst_vlan_set_state(vg, pv, BR_STATE_DISABLED);
 }
 
 int br_mst_vlan_set_msti(struct net_bridge_vlan *mv, u16 msti)
-- 
2.45.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [PATCH net 2/2] net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
  2024-06-09 10:36 [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning Nikolay Aleksandrov
  2024-06-09 10:36 ` [PATCH net 1/2] net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state Nikolay Aleksandrov
@ 2024-06-09 10:36 ` Nikolay Aleksandrov
  2024-06-13  2:00 ` [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning patchwork-bot+netdevbpf
  2 siblings, 0 replies; 4+ messages in thread
From: Nikolay Aleksandrov @ 2024-06-09 10:36 UTC (permalink / raw)
  To: netdev
  Cc: tobias, kuba, roopa, bridge, edumazet, pabeni, horms,
	Nikolay Aleksandrov, syzbot+9bbe2de1bc9d470eb5fe

I converted br_mst_set_state to RCU to avoid a vlan use-after-free
but forgot to change the vlan group dereference helper. Switch to vlan
group RCU deref helper to fix the suspicious rcu usage warning.

Fixes: 3a7c1661ae13 ("net: bridge: mst: fix vlan use-after-free")
Reported-by: syzbot+9bbe2de1bc9d470eb5fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bbe2de1bc9d470eb5fe
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
---
 net/bridge/br_mst.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bridge/br_mst.c b/net/bridge/br_mst.c
index 1de72816b0fb..1820f09ff59c 100644
--- a/net/bridge/br_mst.c
+++ b/net/bridge/br_mst.c
@@ -102,7 +102,7 @@ int br_mst_set_state(struct net_bridge_port *p, u16 msti, u8 state,
 	int err = 0;
 
 	rcu_read_lock();
-	vg = nbp_vlan_group(p);
+	vg = nbp_vlan_group_rcu(p);
 	if (!vg)
 		goto out;
 
-- 
2.45.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning
  2024-06-09 10:36 [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning Nikolay Aleksandrov
  2024-06-09 10:36 ` [PATCH net 1/2] net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state Nikolay Aleksandrov
  2024-06-09 10:36 ` [PATCH net 2/2] net: bridge: mst: fix suspicious rcu usage in br_mst_set_state Nikolay Aleksandrov
@ 2024-06-13  2:00 ` patchwork-bot+netdevbpf
  2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-06-13  2:00 UTC (permalink / raw)
  To: Nikolay Aleksandrov
  Cc: netdev, tobias, kuba, roopa, bridge, edumazet, pabeni, horms

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun,  9 Jun 2024 13:36:52 +0300 you wrote:
> Hi all,
> This set fixes a suspicious RCU usage warning triggered by syzbot[1] in
> the bridge's MST code. After I converted br_mst_set_state to RCU, I
> forgot to update the vlan group dereference helper. Fix it by using
> the proper helper, in order to do that we need to pass the vlan group
> which is already obtained correctly by the callers for their respective
> context. Patch 01 is a requirement for the fix in patch 02.
> 
> [...]

Here is the summary with links:
  - [net,1/2] net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state
    https://git.kernel.org/netdev/net/c/36c92936e868
  - [net,2/2] net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
    https://git.kernel.org/netdev/net/c/546ceb1dfdac

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2024-06-13  2:00 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-06-09 10:36 [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning Nikolay Aleksandrov
2024-06-09 10:36 ` [PATCH net 1/2] net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state Nikolay Aleksandrov
2024-06-09 10:36 ` [PATCH net 2/2] net: bridge: mst: fix suspicious rcu usage in br_mst_set_state Nikolay Aleksandrov
2024-06-13  2:00 ` [PATCH net 0/2] net: bridge: mst: fix suspicious rcu usage warning patchwork-bot+netdevbpf

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.