Eric Dumazet 8bc97117b5 net: bridge: use DEV_STATS_INC() ... [ Upstream commit 44bdb313da ] syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. Handles updates to dev->stats.tx_dropped while we are at it. [1] BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1: br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 run_ksoftirqd+0x17/0x20 kernel/softirq.c:921 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0: br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356 batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703 worker_thread+0x525/0x730 kernel/workqueue.c:2784 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 value changed: 0x00000000000d7190 -> 0x00000000000d7191 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0 Fixes: 1c29fc4989 ("[BRIDGE]: keep track of received multicast packets") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Roopa Prabhu <roopa@nvidia.com> Cc: Nikolay Aleksandrov <razor@blackwall.org> Cc: bridge@lists.linux-foundation.org Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://lore.kernel.org/r/20230918091351.1356153-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-10-06 13:18:07 +02:00
..
netfilter	netfilter: ebtables: fix fortify warnings in size_entry_mwt()	2023-09-23 11:09:56 +02:00
Kconfig	bridge: cfm: Add BRIDGE_CFM to Kconfig.	2020-10-29 18:39:43 -07:00
Makefile	net: bridge: multicast: add EHT host handling functions	2021-01-22 19:39:56 -08:00
br.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-08-13 06:41:22 -07:00
br_arp_nd_proxy.c	net: bridge: when suppression is enabled exclude RARP packets	2021-03-22 13:30:24 -07:00
br_cfm.c	bridge: cfm: remove redundant return	2021-06-22 10:35:15 -07:00
br_cfm_netlink.c	bridge: cfm: Netlink Notifications.	2020-10-29 18:39:44 -07:00
br_device.c	net: bridge: move bridge ioctls out of .ndo_do_ioctl	2021-07-27 20:11:45 +01:00
br_fdb.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-08-13 06:41:22 -07:00
br_forward.c	net: bridge: use DEV_STATS_INC()	2023-10-06 13:18:07 +02:00
br_if.c	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode	2023-07-23 13:47:29 +02:00
br_input.c	net: bridge: use DEV_STATS_INC()	2023-10-06 13:18:07 +02:00
br_ioctl.c	net: bridge: fix ioctl old_deviceless bridge argument	2021-12-29 12:28:46 +01:00
br_mdb.c	net: bridge: vlan: account for router port lists when notifying	2021-08-17 10:37:29 +01:00
br_mrp.c	net: bridge: mrp: Update the Test frames for MRA	2021-06-28 15:46:10 -07:00
br_mrp_netlink.c	bridge: mrp: Use hlist_head instead of list_head for mrp	2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c	bridge: mrp: Extend br_mrp_switchdev to detect better the errors	2021-02-16 14:47:46 -08:00
br_multicast.c	net: bridge: multicast: notify switchdev driver whenever MC processing gets disabled	2022-02-23 12:03:13 +01:00
br_multicast_eht.c	net: bridge: multicast: use multicast contexts instead of bridge or port	2021-07-20 05:41:19 -07:00
br_netfilter_hooks.c	netfilter: br_netfilter: fix recent physdev match breakage	2023-04-26 13:51:47 +02:00
br_netfilter_ipv6.c	netfilter: br_netfilter: Drop dst references before setting.	2022-09-15 11:30:04 +02:00
br_netlink.c	net: bridge: mcast: add and enforce startup query interval minimum	2022-01-05 12:42:37 +01:00
br_netlink_tunnel.c	net: bridge: notify on vlan tunnel changes done via the old api	2020-07-12 15:18:24 -07:00
br_nf_core.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
br_private.h	net: bridge: mcast: fix br_multicast_ctx_vlan_global_disabled helper	2022-01-05 12:42:37 +01:00
br_private_cfm.h	bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.	2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h	net: bridge: multicast: use multicast contexts instead of bridge or port	2021-07-20 05:41:19 -07:00
br_private_mrp.h	net: bridge: mrp: Update the Test frames for MRA	2021-06-28 15:46:10 -07:00
br_private_stp.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
br_private_tunnel.h	bridge: always declare tunnel functions	2023-05-24 17:36:52 +01:00
br_stp.c	net: bridge: constify variables in the replay helpers	2021-06-28 14:09:03 -07:00
br_stp_bpdu.c	net: bridge: add STP xstats	2019-12-14 20:02:36 -08:00
br_stp_if.c	bridge: Add extack warning when enabling STP in netns.	2023-07-27 08:46:59 +02:00
br_stp_timer.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
br_switchdev.c	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
br_sysfs_br.c	net: bridge: mcast: add and enforce startup query interval minimum	2022-01-05 12:42:37 +01:00
br_sysfs_if.c	net: bridge: mcast: br_multicast_set_port_router takes multicast context as argument	2021-08-20 15:00:35 +01:00
br_vlan.c	bridge: switchdev: Fix memory leaks when changing VLAN protocol	2022-11-26 09:24:40 +01:00
br_vlan_options.c	net: bridge: mcast: add and enforce startup query interval minimum	2022-01-05 12:42:37 +01:00
br_vlan_tunnel.c	net: bridge: change return type of br_handle_ingress_vlan_tunnel	2021-08-24 16:51:09 -07:00