Eric Dumazet 2a51edaf5c net/sched: fq_pie: prevent dismantle issue ... commit 61c2402665f1e10c5742033fce18392e369931d7 upstream. For some reason, fq_pie_destroy() did not copy working code from pie_destroy() and other qdiscs, thus causing elusive bug. Before calling del_timer_sync(&q->adapt_timer), we need to ensure timer will not rearm itself. rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (4416 ticks this GP) idle=60d/1/0x4000000000000000 softirq=10433/10434 fqs=2579 (t=10501 jiffies g=13085 q=3989) NMI backtrace for cpu 0 CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 5.16.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343 print_cpu_stall kernel/rcu/tree_stall.h:627 [inline] check_cpu_stall kernel/rcu/tree_stall.h:711 [inline] rcu_pending kernel/rcu/tree.c:3878 [inline] rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2597 update_process_times+0x16d/0x200 kernel/time/timer.c:1785 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline] __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:write_comp_data kernel/kcov.c:221 [inline] RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x1d/0x80 kernel/kcov.c:273 Code: 54 c8 20 48 89 10 c3 66 0f 1f 44 00 00 53 41 89 fb 41 89 f1 bf 03 00 00 00 65 48 8b 0c 25 40 70 02 00 48 89 ce 4c 8b 54 24 08 <e8> 4e f7 ff ff 84 c0 74 51 48 8b 81 88 15 00 00 44 8b 81 84 15 00 RSP: 0018:ffffc90000d27b28 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888064bf1bf0 RCX: ffff888011928000 RDX: ffff888011928000 RSI: ffff888011928000 RDI: 0000000000000003 RBP: ffff888064bf1c28 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff875d8295 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880783dd300 R14: 0000000000000000 R15: 0000000000000000 pie_calculate_probability+0x405/0x7c0 net/sched/sch_pie.c:418 fq_pie_timer+0x170/0x2a0 net/sched/sch_fq_pie.c:383 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Fixes: ec97ecf1eb ("net: sched: add Flow Queue PIE packet scheduler") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Mohit P. Tahiliani <tahiliani@nitk.edu.in> Cc: Sachin D. Patil <sdp.sachin@gmail.com> Cc: V. Saicharan <vsaicharan1998@gmail.com> Cc: Mohit Bhasi <mohitbhasi1998@gmail.com> Cc: Leslie Monis <lesliemonis@gmail.com> Cc: Gautam Ramakrishnan <gautamramk@gmail.com> Link: https://lore.kernel.org/r/20211209084937.3500020-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-14 11:32:37 +01:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-09-15 09:50:34 +02:00
9p	9p/net: fix missing error check in p9_check_errors	2021-11-18 14:04:29 +01:00
802	net/802/garp: fix memleak in garp_request_join()	2021-07-31 08:16:11 +02:00
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:19:08 +01:00
appletalk
atm
ax25
batman-adv	net: batman-adv: fix error handling	2021-11-02 19:48:22 +01:00
bluetooth	Bluetooth: fix init and cleanup of sco_conn.timeout_work	2021-11-18 14:04:01 +01:00
bpf	bpf, test, cgroup: Use sk_{alloc,free} for test cases	2021-10-27 09:56:56 +02:00
bpfilter
bridge	net: bridge: mcast: use multicast_membership_interval for IGMPv3	2021-10-27 09:56:54 +02:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-22 12:27:56 +02:00
can	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM	2021-12-08 09:03:17 +01:00
ceph
core	devlink: fix netns refcount leak in devlink_nl_cmd_reload()	2021-12-14 11:32:37 +01:00
dcb
dccp	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 14:04:08 +01:00
decnet	net: decnet: Fix sleeping inside in af_decnet	2021-07-28 14:35:38 +02:00
dns_resolver
dsa	net: dsa: don't allocate the slave_mii_bus using devres	2021-09-30 10:11:02 +02:00
ethernet
ethtool	ethtool: fix ethtool msg len calculation for pause stats	2021-11-18 14:04:25 +01:00
hsr
ieee802154	net: Fix memory leak in ieee802154_raw_deliver	2021-08-18 08:59:12 +02:00
ife
ipv4	udp: using datalen to cap max gso segments	2021-12-14 11:32:37 +01:00
ipv6	seg6: fix the iif in the IPv6 socket control block	2021-12-14 11:32:36 +01:00
iucv
kcm
key
l2tp	net/l2tp: Fix reference count leak in l2tp_udp_recv_core	2021-09-22 12:27:56 +02:00
l3mdev
lapb
llc	net: llc: fix skb_over_panic	2021-08-04 12:46:43 +02:00
mac80211	mac80211: do not access the IV when it was stripped	2021-12-08 09:03:18 +01:00
mac802154
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:03:23 +01:00
mptcp	mptcp: fix delack timer	2021-12-01 09:19:04 +01:00
ncsi	net/ncsi : Add payload to be 32-bit aligned to fix dropped packets	2021-12-01 09:19:06 +01:00
netfilter	netfilter: conntrack: annotate data-races around ct->timeout	2021-12-14 11:32:37 +01:00
netlabel	net: fix NULL pointer reference in cipso_v4_doi_free	2021-09-18 13:40:35 +02:00
netlink	netlink: annotate data races around nlk->bound	2021-10-13 10:04:27 +02:00
netrom	netrom: Decrease sock refcount when sock timers expire	2021-07-28 14:35:38 +02:00
nfc	nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done	2021-12-14 11:32:36 +01:00
nsh
openvswitch	ovs: clear skb->tstamp in forwarding path	2021-08-26 08:35:50 -04:00
packet
phonet
psample
qrtr	net: qrtr: fix another OOB Read in qrtr_endpoint_post	2021-09-03 10:09:21 +02:00
rds	net/rds: correct socket tunable error in rds_tcp_tune()	2021-12-08 09:03:26 +01:00
rfkill
rose
rxrpc	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()	2021-12-08 09:03:25 +01:00
sched	net/sched: fq_pie: prevent dismantle issue	2021-12-14 11:32:37 +01:00
sctp	sctp: add vtag check in sctp_sf_ootb	2021-11-02 19:48:24 +01:00
smc	net/smc: Keep smc_close_final rc during active close	2021-12-08 09:03:26 +01:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 14:04:27 +01:00
sunrpc	SUNRPC: Partial revert of commit 6f9f17287e	2021-11-18 14:04:32 +01:00
switchdev
tipc	tipc: check for null after calling kmemdup	2021-11-26 10:39:19 +01:00
tls	net/tls: Fix authentication failure in CCM mode	2021-12-08 09:03:29 +01:00
unix	af_unix: fix races in sk_peer_pid and sk_peer_cred accesses	2021-10-06 15:55:58 +02:00
vmw_vsock	vsock: prevent unnecessary refcnt inc for nonblocking connect	2021-11-18 14:04:28 +01:00
wimax
wireless	cfg80211: call cfg80211_stop_ap when switch from P2P_GO type	2021-11-26 10:39:20 +01:00
x25
xdp
xfrm	net: xfrm: Fix end of loop tests for list_for_each_entry	2021-08-26 08:35:35 -04:00
compat.c
devres.c
Kconfig
Makefile
socket.c	ethtool: improve compat ioctl handling	2021-09-18 13:40:21 +02:00
sysctl_net.c