• Eric Dumazet's avatar
    virtio_net: use u64_stats_t infra to avoid data-races · 61217d8f
    Eric Dumazet authored
    syzbot reported a data-race in virtnet_poll / virtnet_stats [1]
    
    u64_stats_t infra has very nice accessors that must be used
    to avoid potential load-store tearing.
    
    [1]
    BUG: KCSAN: data-race in virtnet_poll / virtnet_stats
    
    read-write to 0xffff88810271b1a0 of 8 bytes by interrupt on cpu 0:
    virtnet_receive drivers/net/virtio_net.c:2102 [inline]
    virtnet_poll+0x6c8/0xb40 drivers/net/virtio_net.c:2148
    __napi_poll+0x60/0x3b0 net/core/dev.c:6527
    napi_poll net/core/dev.c:6594 [inline]
    net_rx_action+0x32b/0x750 net/core/dev.c:6727
    __do_softirq+0xc1/0x265 kernel/softirq.c:553
    invoke_softirq kernel/softirq.c:427 [inline]
    __irq_exit_rcu kernel/softirq.c:632 [inline]
    irq_exit_rcu+0x3b/0x90 kernel/softirq.c:644
    common_interrupt+0x7f/0x90 arch/x86/kernel/irq.c:247
    asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:636
    __sanitizer_cov_trace_const_cmp8+0x0/0x80 kernel/kcov.c:306
    jbd2_write_access_granted fs/jbd2/transaction.c:1174 [inline]
    jbd2_journal_get_write_access+0x94/0x1c0 fs/jbd2/transaction.c:1239
    __ext4_journal_get_write_access+0x154/0x3f0 fs/ext4/ext4_jbd2.c:241
    ext4_reserve_inode_write+0x14e/0x200 fs/ext4/inode.c:5745
    __ext4_mark_inode_dirty+0x8e/0x440 fs/ext4/inode.c:5919
    ext4_evict_inode+0xaf0/0xdc0 fs/ext4/inode.c:299
    evict+0x1aa/0x410 fs/inode.c:664
    iput_final fs/inode.c:1775 [inline]
    iput+0x42c/0x5b0 fs/inode.c:1801
    do_unlinkat+0x2b9/0x4f0 fs/namei.c:4405
    __do_sys_unlink fs/namei.c:4446 [inline]
    __se_sys_unlink fs/namei.c:4444 [inline]
    __x64_sys_unlink+0x30/0x40 fs/namei.c:4444
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    read to 0xffff88810271b1a0 of 8 bytes by task 2814 on cpu 1:
    virtnet_stats+0x1b3/0x340 drivers/net/virtio_net.c:2564
    dev_get_stats+0x6d/0x860 net/core/dev.c:10511
    rtnl_fill_stats+0x45/0x320 net/core/rtnetlink.c:1261
    rtnl_fill_ifinfo+0xd0e/0x1120 net/core/rtnetlink.c:1867
    rtnl_dump_ifinfo+0x7f9/0xc20 net/core/rtnetlink.c:2240
    netlink_dump+0x390/0x720 net/netlink/af_netlink.c:2266
    netlink_recvmsg+0x425/0x780 net/netlink/af_netlink.c:1992
    sock_recvmsg_nosec net/socket.c:1027 [inline]
    sock_recvmsg net/socket.c:1049 [inline]
    ____sys_recvmsg+0x156/0x310 net/socket.c:2760
    ___sys_recvmsg net/socket.c:2802 [inline]
    __sys_recvmsg+0x1ea/0x270 net/socket.c:2832
    __do_sys_recvmsg net/socket.c:2842 [inline]
    __se_sys_recvmsg net/socket.c:2839 [inline]
    __x64_sys_recvmsg+0x46/0x50 net/socket.c:2839
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    value changed: 0x000000000045c334 -> 0x000000000045c376
    
    Fixes: 3fa2a1df ("virtio-net: per cpu 64 bit stats (v2)")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    61217d8f
virtio_net.c 126 KB