Eric Dumazet f2ef4cb4d4 net: bridge: use DEV_STATS_INC() ... [ Upstream commit 44bdb313da ] syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. Handles updates to dev->stats.tx_dropped while we are at it. [1] BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1: br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 run_ksoftirqd+0x17/0x20 kernel/softirq.c:921 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0: br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356 batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703 worker_thread+0x525/0x730 kernel/workqueue.c:2784 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 value changed: 0x00000000000d7190 -> 0x00000000000d7191 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0 Fixes: 1c29fc4989 ("[BRIDGE]: keep track of received multicast packets") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Roopa Prabhu <roopa@nvidia.com> Cc: Nikolay Aleksandrov <razor@blackwall.org> Cc: bridge@lists.linux-foundation.org Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://lore.kernel.org/r/20230918091351.1356153-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-10-06 13:15:56 +02:00
..
netfilter	netfilter: ebtables: fix fortify warnings in size_entry_mwt()	2023-09-23 11:14:22 +02:00
br_arp_nd_proxy.c	bridge: Add per-{Port, VLAN} neighbor suppression data path support	2023-04-21 08:25:50 +01:00
br_cfm_netlink.c	bridge: cfm: Netlink Notifications.	2020-10-29 18:39:44 -07:00
br_cfm.c	bridge: cfm: remove redundant return	2021-06-22 10:35:15 -07:00
br_device.c	skbuff: bridge: Add layer 2 miss indication	2023-05-30 23:37:00 -07:00
br_fdb.c	bridge: switchdev: Allow device drivers to install locked FDB entries	2022-11-09 19:06:13 -08:00
br_forward.c	net: bridge: use DEV_STATS_INC()	2023-10-06 13:15:56 +02:00
br_if.c	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode	2023-07-03 09:11:34 +01:00
br_input.c	net: bridge: use DEV_STATS_INC()	2023-10-06 13:15:56 +02:00
br_ioctl.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-12-31 14:35:40 +00:00
br_mdb.c	rtnetlink: bridge: mcast: Relax group address validation in common code	2023-03-17 08:05:49 +00:00
br_mrp_netlink.c	bridge: mrp: Use hlist_head instead of list_head for mrp	2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c	bridge: mrp: Extend br_mrp_switchdev to detect better the errors	2021-02-16 14:47:46 -08:00
br_mrp.c	net: bridge: mrp: Update the Test frames for MRA	2021-06-28 15:46:10 -07:00
br_mst.c	net: bridge: mst: Add helper to query a port's MST state	2022-03-17 16:49:58 -07:00
br_multicast_eht.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
br_multicast.c	net: bridge: Add netlink knobs for number / maximum MDB entries	2023-02-06 08:48:26 +00:00
br_netfilter_hooks.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-20 16:29:51 -07:00
br_netfilter_ipv6.c	netfilter: move br_nf_check_hbh_len to utils	2023-03-08 14:25:40 +01:00
br_netlink_tunnel.c	net: bridge: Set strict_start_type at two policies	2023-02-06 08:48:25 +00:00
br_netlink.c	bridge: Allow setting per-{Port, VLAN} neighbor suppression state	2023-04-21 08:25:50 +01:00
br_nf_core.c	net: dst: Switch to rcuref_t reference counting	2023-03-28 18:52:28 -07:00
br_private_cfm.h	bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.	2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h	net: bridge: multicast: use multicast contexts instead of bridge or port	2021-07-20 05:41:19 -07:00
br_private_mrp.h	net: bridge: mrp: Update the Test frames for MRA	2021-06-28 15:46:10 -07:00
br_private_stp.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
br_private_tunnel.h	bridge: always declare tunnel functions	2023-05-17 21:28:58 -07:00
br_private.h	skbuff: bridge: Add layer 2 miss indication	2023-05-30 23:37:00 -07:00
br_stp_bpdu.c	net: bridge: add STP xstats	2019-12-14 20:02:36 -08:00
br_stp_if.c	net: use eth_hw_addr_set()	2021-10-02 14:18:25 +01:00
br_stp_timer.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
br_stp.c	net: bridge: mst: Multiple Spanning Tree (MST) mode	2022-03-17 16:49:57 -07:00
br_switchdev.c	net: bridge: switchdev: don't notify FDB entries with "master dynamic"	2023-04-20 09:20:14 +02:00
br_sysfs_br.c	bridge: Fix flushing of dynamic FDB entries	2022-11-02 20:47:09 -07:00
br_sysfs_if.c	bridge: move from strlcpy with unused retval to strscpy	2022-08-22 17:57:30 -07:00
br_vlan_options.c	bridge: vlan: Allow setting VLAN neighbor suppression state	2023-04-21 08:25:50 +01:00
br_vlan_tunnel.c	net: bridge: change return type of br_handle_ingress_vlan_tunnel	2021-08-24 16:51:09 -07:00
br_vlan.c	bridge: vlan: Allow setting VLAN neighbor suppression state	2023-04-21 08:25:50 +01:00
br.c	bridge: switchdev: Allow device drivers to install locked FDB entries	2022-11-09 19:06:13 -08:00
Kconfig	bridge: cfm: Add BRIDGE_CFM to Kconfig.	2020-10-29 18:39:43 -07:00
Makefile	net: bridge: mst: Multiple Spanning Tree (MST) mode	2022-03-17 16:49:57 -07:00