[Patch net] net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()

[Patch net] net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()

[Cong Wang]

syzbot reported some bogus lockdep warnings, for example bad unlock
balance in sch_direct_xmit(). They are due to a race condition between
slow path and fast path, that is qdisc_xmit_lock_key gets re-registered
in netdev_update_lockdep_key() on slow path, while we could still
acquire the queue->_xmit_lock on fast path in this small window:

CPU A						CPU B
						__netif_tx_lock();
lockdep_unregister_key(qdisc_xmit_lock_key);
						__netif_tx_unlock();
lockdep_register_key(qdisc_xmit_lock_key);

In fact, unlike the addr_list_lock which has to be reordered when
the master/slave device relationship changes, queue->_xmit_lock is
only acquired on fast path and only when NETIF_F_LLTX is not set,
so there is likely no nested locking for it.

Therefore, we can just get rid of re-registration of
qdisc_xmit_lock_key.

Reported-by: syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com
Fixes: ab92d68fc22f ("net: core: add generic lockdep keys")
Cc: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/core/dev.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 0ad39c87b7fd..7e885d069707 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9177,22 +9177,10 @@ static void netdev_unregister_lockdep_key(struct net_device *dev)
 
 void netdev_update_lockdep_key(struct net_device *dev)
 {
-	struct netdev_queue *queue;
-	int i;
-
-	lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
 	lockdep_unregister_key(&dev->addr_list_lock_key);
-
-	lockdep_register_key(&dev->qdisc_xmit_lock_key);
 	lockdep_register_key(&dev->addr_list_lock_key);
 
 	lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
-	for (i = 0; i < dev->num_tx_queues; i++) {
-		queue = netdev_get_tx_queue(dev, i);
-
-		lockdep_set_class(&queue->_xmit_lock,
-				  &dev->qdisc_xmit_lock_key);
-	}
 }
 EXPORT_SYMBOL(netdev_update_lockdep_key);
 
-- 
2.21.1

Re: [Patch net] net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()

[Taehee Yoo]

On Thu, 16 Jan 2020 at 06:02, Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> syzbot reported some bogus lockdep warnings, for example bad unlock
> balance in sch_direct_xmit(). They are due to a race condition between
> slow path and fast path, that is qdisc_xmit_lock_key gets re-registered
> in netdev_update_lockdep_key() on slow path, while we could still
> acquire the queue->_xmit_lock on fast path in this small window:
>
> CPU A                                           CPU B
>                                                 __netif_tx_lock();
> lockdep_unregister_key(qdisc_xmit_lock_key);
>                                                 __netif_tx_unlock();
> lockdep_register_key(qdisc_xmit_lock_key);
>
> In fact, unlike the addr_list_lock which has to be reordered when
> the master/slave device relationship changes, queue->_xmit_lock is
> only acquired on fast path and only when NETIF_F_LLTX is not set,
> so there is likely no nested locking for it.
>
> Therefore, we can just get rid of re-registration of
> qdisc_xmit_lock_key.
>
> Reported-by: syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com
> Fixes: ab92d68fc22f ("net: core: add generic lockdep keys")

Thank you for fixing this bug!

Acked-by: Taehee Yoo <ap420073@gmail.com>

Re: [Patch net] net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()

[David Miller]

From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Wed, 15 Jan 2020 13:02:38 -0800

> syzbot reported some bogus lockdep warnings, for example bad unlock
> balance in sch_direct_xmit(). They are due to a race condition between
> slow path and fast path, that is qdisc_xmit_lock_key gets re-registered
> in netdev_update_lockdep_key() on slow path, while we could still
> acquire the queue->_xmit_lock on fast path in this small window:
> 
> CPU A						CPU B
> 						__netif_tx_lock();
> lockdep_unregister_key(qdisc_xmit_lock_key);
> 						__netif_tx_unlock();
> lockdep_register_key(qdisc_xmit_lock_key);
> 
> In fact, unlike the addr_list_lock which has to be reordered when
> the master/slave device relationship changes, queue->_xmit_lock is
> only acquired on fast path and only when NETIF_F_LLTX is not set,
> so there is likely no nested locking for it.
> 
> Therefore, we can just get rid of re-registration of
> qdisc_xmit_lock_key.
> 
> Reported-by: syzbot+4ec99438ed7450da6272@syzkaller.appspotmail.com
> Fixes: ab92d68fc22f ("net: core: add generic lockdep keys")
> Cc: Taehee Yoo <ap420073@gmail.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Applied and queued up for -stable, thanks.