Eric Dumazet d86216dfda net/sched: fq_pie: prevent dismantle issue ... commit 61c2402665 upstream. For some reason, fq_pie_destroy() did not copy working code from pie_destroy() and other qdiscs, thus causing elusive bug. Before calling del_timer_sync(&q->adapt_timer), we need to ensure timer will not rearm itself. rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (4416 ticks this GP) idle=60d/1/0x4000000000000000 softirq=10433/10434 fqs=2579 (t=10501 jiffies g=13085 q=3989) NMI backtrace for cpu 0 CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 5.16.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343 print_cpu_stall kernel/rcu/tree_stall.h:627 [inline] check_cpu_stall kernel/rcu/tree_stall.h:711 [inline] rcu_pending kernel/rcu/tree.c:3878 [inline] rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2597 update_process_times+0x16d/0x200 kernel/time/timer.c:1785 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749 hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline] __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:write_comp_data kernel/kcov.c:221 [inline] RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x1d/0x80 kernel/kcov.c:273 Code: 54 c8 20 48 89 10 c3 66 0f 1f 44 00 00 53 41 89 fb 41 89 f1 bf 03 00 00 00 65 48 8b 0c 25 40 70 02 00 48 89 ce 4c 8b 54 24 08 <e8> 4e f7 ff ff 84 c0 74 51 48 8b 81 88 15 00 00 44 8b 81 84 15 00 RSP: 0018:ffffc90000d27b28 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888064bf1bf0 RCX: ffff888011928000 RDX: ffff888011928000 RSI: ffff888011928000 RDI: 0000000000000003 RBP: ffff888064bf1c28 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff875d8295 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880783dd300 R14: 0000000000000000 R15: 0000000000000000 pie_calculate_probability+0x405/0x7c0 net/sched/sch_pie.c:418 fq_pie_timer+0x170/0x2a0 net/sched/sch_fq_pie.c:383 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Fixes: ec97ecf1eb ("net: sched: add Flow Queue PIE packet scheduler") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Mohit P. Tahiliani <tahiliani@nitk.edu.in> Cc: Sachin D. Patil <sdp.sachin@gmail.com> Cc: V. Saicharan <vsaicharan1998@gmail.com> Cc: Mohit Bhasi <mohitbhasi1998@gmail.com> Cc: Leslie Monis <lesliemonis@gmail.com> Cc: Gautam Ramakrishnan <gautamramk@gmail.com> Link: https://lore.kernel.org/r/20211209084937.3500020-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-14 10:57:10 +01:00
..
6lowpan	…
9p	…
802	…
8021q	net: vlan: fix underflow for the real_dev refcnt	2021-12-01 09:04:53 +01:00
appletalk	…
atm	…
ax25	…
batman-adv	…
bluetooth	…
bpf	…
bpfilter	…
bridge	…
caif	…
can	…
ceph	…
core	devlink: fix netns refcount leak in devlink_nl_cmd_reload()	2021-12-14 10:57:10 +01:00
dcb	…
dccp	…
decnet	…
dns_resolver	…
dsa	…
ethernet	…
ethtool	ethtool: do not perform operations on net devices being unregistered	2021-12-14 10:57:09 +01:00
hsr	…
ieee802154	…
ife	…
ipv4	udp: using datalen to cap max gso segments	2021-12-14 10:57:09 +01:00
ipv6	seg6: fix the iif in the IPv6 socket control block	2021-12-14 10:57:09 +01:00
iucv	…
kcm	…
key	…
l2tp	…
l3mdev	…
lapb	…
llc	…
mac80211	mac80211: fix throughput LED trigger	2021-12-08 09:04:38 +01:00
mac802154	…
mctp	mctp: Don't let RTM_DELROUTE delete local routes	2021-12-08 09:04:53 +01:00
mpls	net: mpls: Fix notifications when deleting a device	2021-12-08 09:04:47 +01:00
mptcp	…
ncsi	net/ncsi : Add payload to be 32-bit aligned to fix dropped packets	2021-12-01 09:04:51 +01:00
netfilter	netfilter: conntrack: annotate data-races around ct->timeout	2021-12-14 10:57:10 +01:00
netlabel	…
netlink	…
netrom	…
nfc	nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done	2021-12-14 10:57:08 +01:00
nsh	…
openvswitch	…
packet	…
phonet	…
psample	…
qrtr	…
rds	net/rds: correct socket tunable error in rds_tcp_tune()	2021-12-08 09:04:50 +01:00
rfkill	…
rose	…
rxrpc	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()	2021-12-08 09:04:49 +01:00
sched	net/sched: fq_pie: prevent dismantle issue	2021-12-14 10:57:10 +01:00
sctp	…
smc	net/smc: Keep smc_close_final rc during active close	2021-12-08 09:04:50 +01:00
strparser	…
sunrpc	…
switchdev	…
tipc	…
tls	net/tls: Fix authentication failure in CCM mode	2021-12-08 09:04:41 +01:00
unix	af_unix: fix regression in read after shutdown	2021-12-01 09:04:49 +01:00
vmw_vsock	…
wireless	…
x25	…
xdp	…
xfrm	…
Kconfig	…
Makefile	…
compat.c	…
devres.c	…
socket.c	…
sysctl_net.c	…