net/ipv6/ip6_flowlabel.c:543 suspicious rcu_dereference_check() usage!

net/ipv6/ip6_flowlabel.c:543 suspicious rcu_dereference_check() usage!

[Dave Jones]

===============================
[ INFO: suspicious RCU usage. ]
4.5.0-rc2-think+ #2 Tainted: G        W      
-------------------------------
net/ipv6/ip6_flowlabel.c:543 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 1, debug_locks = 1
2 locks held by trinity-c0/21982:
 #0:  (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffffb1161dec>] do_ipv6_setsockopt.isra.5+0x1bc/0x1c20
 #1:  (ip6_sk_fl_lock){+.....}, at: [<ffffffffb11a2784>] ipv6_flowlabel_opt+0x584/0x1b00

stack backtrace:
CPU: 1 PID: 21982 Comm: trinity-c0 Tainted: G        W       4.5.0-rc2-think+ #2
 ffffffffb1821f20 00000000e98d3751 ffff88032ccaf798 ffffffffb076bd50
 0000000041b58ab3 ffffffffb19d0db1 ffffffffb076bca5 0000000000000001
 ffff8803011308e8 00000000e98d3751 ffff88032ccaf770 0000000000000003
Call Trace:
 [<ffffffffb076bd50>] dump_stack+0xab/0x11b
 [<ffffffffb076bca5>] ? _atomic_dec_and_lock+0x95/0x95
 [<ffffffffb01867f6>] lockdep_rcu_suspicious+0xe6/0x100
 [<ffffffffb11a282b>] ipv6_flowlabel_opt+0x62b/0x1b00
 [<ffffffffb11a2200>] ? ipv6_flowlabel_opt_get+0x6b0/0x6b0
 [<ffffffffb01275ca>] ? preempt_count_sub+0x1a/0x140
 [<ffffffffb018a5d8>] ? mark_held_locks+0xc8/0x140
 [<ffffffffb00ea294>] ? __local_bh_enable_ip+0x64/0xc0
 [<ffffffffb0f08c4a>] ? lock_sock_nested+0x5a/0xe0
 [<ffffffffb018a9ed>] ? trace_hardirqs_on+0xd/0x10
 [<ffffffffb00ea294>] ? __local_bh_enable_ip+0x64/0xc0
 [<ffffffffb0f08c99>] ? lock_sock_nested+0xa9/0xe0
 [<ffffffffb11627f4>] do_ipv6_setsockopt.isra.5+0xbc4/0x1c20
 [<ffffffffb01b642f>] ? debug_lockdep_rcu_enabled.part.34+0x1f/0x40
 [<ffffffffb1161c30>] ? ip6_ra_control+0x1d0/0x1d0
 [<ffffffffb0189974>] ? mark_lock+0xf4/0xc90
 [<ffffffffb0189880>] ? print_usage_bug+0x520/0x520
 [<ffffffffb0189880>] ? print_usage_bug+0x520/0x520
 [<ffffffffb0016979>] ? native_sched_clock+0x69/0x160
 [<ffffffffb018b71e>] ? __lock_acquire+0x7ee/0x2ec0
 [<ffffffffb0189974>] ? mark_lock+0xf4/0xc90
 [<ffffffffb0189880>] ? print_usage_bug+0x520/0x520
 [<ffffffffb018af30>] ? debug_check_no_locks_freed+0x200/0x200
 [<ffffffffb018b71e>] ? __lock_acquire+0x7ee/0x2ec0
 [<ffffffffb0127679>] ? preempt_count_sub+0xc9/0x140
 [<ffffffffb07b4177>] ? debug_smp_processor_id+0x17/0x20
 [<ffffffffb018152e>] ? get_lock_stats+0x4e/0xf0
 [<ffffffffb0127679>] ? preempt_count_sub+0xc9/0x140
 [<ffffffffb01822a3>] ? trace_hardirqs_off_caller+0x73/0x150
 [<ffffffffb018238d>] ? trace_hardirqs_off+0xd/0x10
 [<ffffffffb0263b98>] ? __acct_update_integrals+0x108/0x260
 [<ffffffffb0263a90>] ? taskstats_exit+0x5f0/0x5f0
 [<ffffffffb07b4177>] ? debug_smp_processor_id+0x17/0x20
 [<ffffffffb018152e>] ? get_lock_stats+0x4e/0xf0
 [<ffffffffb0127679>] ? preempt_count_sub+0xc9/0x140
 [<ffffffffb0146181>] ? account_user_time+0x141/0x200
 [<ffffffffb1163881>] ipv6_setsockopt+0x31/0xe0
 [<ffffffffb10157a1>] tcp_setsockopt+0x71/0xd0
 [<ffffffffb0f07a3c>] sock_common_setsockopt+0x6c/0xb0
 [<ffffffffb0f04ee6>] SyS_setsockopt+0x116/0x200
 [<ffffffffb0f04dd0>] ? SyS_recv+0x20/0x20
 [<ffffffffb11f625a>] ? int_ret_from_sys_call+0x52/0x9f
 [<ffffffffb0002017>] ? trace_hardirqs_on_thunk+0x17/0x19
 [<ffffffffb11f60d7>] entry_SYSCALL_64_fastpath+0x12/0x6b

[PATCH net] ipv6: fix a lockdep splat

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

Silence lockdep false positive about rcu_dereference() being
used in the wrong context.

First one should use rcu_dereference_protected() as we own the spinlock.

Second one should be a normal assignation, as no barrier is needed.

Fixes: 18367681a10bd ("ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.")
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv6/ip6_flowlabel.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1f9ebe3cbb4a..dc2db4f7b182 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -540,12 +540,13 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 		}
 		spin_lock_bh(&ip6_sk_fl_lock);
 		for (sflp = &np->ipv6_fl_list;
-		     (sfl = rcu_dereference(*sflp)) != NULL;
+		     (sfl = rcu_dereference_protected(*sflp,
+						      lockdep_is_held(&ip6_sk_fl_lock))) != NULL;
 		     sflp = &sfl->next) {
 			if (sfl->fl->label == freq.flr_label) {
 				if (freq.flr_label == (np->flow_label&IPV6_FLOWLABEL_MASK))
 					np->flow_label &= ~IPV6_FLOWLABEL_MASK;
-				*sflp = rcu_dereference(sfl->next);
+				*sflp = sfl->next;
 				spin_unlock_bh(&ip6_sk_fl_lock);
 				fl_release(sfl->fl);
 				kfree_rcu(sfl, rcu);

Re: [PATCH net] ipv6: fix a lockdep splat

[Hannes Frederic Sowa]

On 03.02.2016 02:55, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> Silence lockdep false positive about rcu_dereference() being
> used in the wrong context.
>
> First one should use rcu_dereference_protected() as we own the spinlock.
 >
> Second one should be a normal assignation, as no barrier is needed.

Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

Re: [PATCH net] ipv6: fix a lockdep splat

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 02 Feb 2016 17:55:01 -0800

> From: Eric Dumazet <edumazet@google.com>
> 
> Silence lockdep false positive about rcu_dereference() being
> used in the wrong context.
> 
> First one should use rcu_dereference_protected() as we own the spinlock.
> 
> Second one should be a normal assignation, as no barrier is needed.
> 
> Fixes: 18367681a10bd ("ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.")
> Reported-by: Dave Jones <davej@codemonkey.org.uk>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied and queued up for -stable, thanks.