Commit d4d40dc7 authored Sep 05, 2023 by Eric Dumazet Committed by Greg Kroah-Hartman Oct 25, 2023

xfrm: interface: use DEV_STATS_INC()



commit f7c4e3e5d4f6609b4725a97451948ca2e425379a upstream.

syzbot/KCSAN reported data-races in xfrm whenever dev->stats fields
are updated.

It appears all of these updates can happen from multiple cpus.

Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.

BUG: KCSAN: data-race in xfrmi_xmit / xfrmi_xmit

read-write to 0xffff88813726b160 of 8 bytes by task 23986 on cpu 1:
xfrmi_xmit+0x74e/0xb20 net/xfrm/xfrm_interface_core.c:583
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
neigh_connected_output+0x231/0x2a0 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:542 [inline]
ip_finish_output2+0x74a/0x850 net/ipv4/ip_output.c:230
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:127 [inline]
ip_send_skb+0x72/0xe0 net/ipv4/ip_output.c:1487
udp_send_skb+0x6a4/0x990 net/ipv4/udp.c:963
udp_sendmsg+0x1249/0x12d0 net/ipv4/udp.c:1246
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:840
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2540
___sys_sendmsg net/socket.c:2594 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2680
__do_sys_sendmmsg net/socket.c:2709 [inline]
__se_sys_sendmmsg net/socket.c:2706 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2706
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

read-write to 0xffff88813726b160 of 8 bytes by task 23987 on cpu 0:
xfrmi_xmit+0x74e/0xb20 net/xfrm/xfrm_interface_core.c:583
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
neigh_connected_output+0x231/0x2a0 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:542 [inline]
ip_finish_output2+0x74a/0x850 net/ipv4/ip_output.c:230
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:127 [inline]
ip_send_skb+0x72/0xe0 net/ipv4/ip_output.c:1487
udp_send_skb+0x6a4/0x990 net/ipv4/udp.c:963
udp_sendmsg+0x1249/0x12d0 net/ipv4/udp.c:1246
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:840
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2540
___sys_sendmsg net/socket.c:2594 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2680
__do_sys_sendmmsg net/socket.c:2709 [inline]
__se_sys_sendmmsg net/socket.c:2706 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2706
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000000010d7 -> 0x00000000000010d8

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 23987 Comm: syz-executor.5 Not tainted 6.5.0-syzkaller-10885-g0468be89b3fa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023

Fixes: f203b76d ("xfrm: Add virtual xfrm interfaces")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 17c75411

net/xfrm/xfrm_interface_core.c

+10 −12

Original line number	Original line	Diff line number	Diff line
	@@ -219,8 +219,8 @@ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
	skb->dev = dev;		skb->dev = dev;

	if (err) {		if (err) {
	dev->stats.rx_errors++;		DEV_STATS_INC(dev, rx_errors);
	dev->stats.rx_dropped++;		DEV_STATS_INC(dev, rx_dropped);

	return 0;		return 0;
	}		}
	@@ -260,7 +260,6 @@ static int
	xfrmi_xmit2(struct sk_buff skb, struct net_device dev, struct flowi *fl)		xfrmi_xmit2(struct sk_buff skb, struct net_device dev, struct flowi *fl)
	{		{
	struct xfrm_if *xi = netdev_priv(dev);		struct xfrm_if *xi = netdev_priv(dev);
	struct net_device_stats *stats = &xi->dev->stats;
	struct dst_entry *dst = skb_dst(skb);		struct dst_entry *dst = skb_dst(skb);
	unsigned int length = skb->len;		unsigned int length = skb->len;
	struct net_device *tdev;		struct net_device *tdev;
	@@ -286,7 +285,7 @@ xfrmi_xmit2(struct sk_buff skb, struct net_device dev, struct flowi *fl)
	tdev = dst->dev;		tdev = dst->dev;

	if (tdev == dev) {		if (tdev == dev) {
	stats->collisions++;		DEV_STATS_INC(dev, collisions);
	net_warn_ratelimited("%s: Local routing loop detected!\n",		net_warn_ratelimited("%s: Local routing loop detected!\n",
	dev->name);		dev->name);
	goto tx_err_dst_release;		goto tx_err_dst_release;
	@@ -329,13 +328,13 @@ xfrmi_xmit2(struct sk_buff skb, struct net_device dev, struct flowi *fl)
	tstats->tx_packets++;		tstats->tx_packets++;
	u64_stats_update_end(&tstats->syncp);		u64_stats_update_end(&tstats->syncp);
	} else {		} else {
	stats->tx_errors++;		DEV_STATS_INC(dev, tx_errors);
	stats->tx_aborted_errors++;		DEV_STATS_INC(dev, tx_aborted_errors);
	}		}

	return 0;		return 0;
	tx_err_link_failure:		tx_err_link_failure:
	stats->tx_carrier_errors++;		DEV_STATS_INC(dev, tx_carrier_errors);
	dst_link_failure(skb);		dst_link_failure(skb);
	tx_err_dst_release:		tx_err_dst_release:
	dst_release(dst);		dst_release(dst);
	@@ -345,7 +344,6 @@ xfrmi_xmit2(struct sk_buff skb, struct net_device dev, struct flowi *fl)
	static netdev_tx_t xfrmi_xmit(struct sk_buff skb, struct net_device dev)		static netdev_tx_t xfrmi_xmit(struct sk_buff skb, struct net_device dev)
	{		{
	struct xfrm_if *xi = netdev_priv(dev);		struct xfrm_if *xi = netdev_priv(dev);
	struct net_device_stats *stats = &xi->dev->stats;
	struct dst_entry *dst = skb_dst(skb);		struct dst_entry *dst = skb_dst(skb);
	struct flowi fl;		struct flowi fl;
	int ret;		int ret;
	@@ -362,7 +360,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff skb, struct net_device dev)
	dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);		dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
	if (dst->error) {		if (dst->error) {
	dst_release(dst);		dst_release(dst);
	stats->tx_carrier_errors++;		DEV_STATS_INC(dev, tx_carrier_errors);
	goto tx_err;		goto tx_err;
	}		}
	skb_dst_set(skb, dst);		skb_dst_set(skb, dst);
	@@ -378,7 +376,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff skb, struct net_device dev)
	fl.u.ip4.flowi4_flags \|= FLOWI_FLAG_ANYSRC;		fl.u.ip4.flowi4_flags \|= FLOWI_FLAG_ANYSRC;
	rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);		rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
	if (IS_ERR(rt)) {		if (IS_ERR(rt)) {
	stats->tx_carrier_errors++;		DEV_STATS_INC(dev, tx_carrier_errors);
	goto tx_err;		goto tx_err;
	}		}
	skb_dst_set(skb, &rt->dst);		skb_dst_set(skb, &rt->dst);
	@@ -397,8 +395,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff skb, struct net_device dev)
	return NETDEV_TX_OK;		return NETDEV_TX_OK;

	tx_err:		tx_err:
	stats->tx_errors++;		DEV_STATS_INC(dev, tx_errors);
	stats->tx_dropped++;		DEV_STATS_INC(dev, tx_dropped);
	kfree_skb(skb);		kfree_skb(skb);
	return NETDEV_TX_OK;		return NETDEV_TX_OK;
	}		}