Daniel Borkmann 81d947e2b8 net, sched: fix panic when updating miniq {b,q}stats ... While working on fixing another bug, I ran into the following panic on arm64 by simply attaching clsact qdisc, adding a filter and running traffic on ingress to it: [...] [ 178.188591] Unable to handle kernel read from unreadable memory at virtual address 810fb501f000 [ 178.197314] Mem abort info: [ 178.200121] ESR = 0x96000004 [ 178.203168] Exception class = DABT (current EL), IL = 32 bits [ 178.209095] SET = 0, FnV = 0 [ 178.212157] EA = 0, S1PTW = 0 [ 178.215288] Data abort info: [ 178.218175] ISV = 0, ISS = 0x00000004 [ 178.222019] CM = 0, WnR = 0 [ 178.224997] user pgtable: 4k pages, 48-bit VAs, pgd = 0000000023cb3f33 [ 178.231531] [0000810fb501f000] *pgd=0000000000000000 [ 178.236508] Internal error: Oops: 96000004 [#1] SMP [...] [ 178.311855] CPU: 73 PID: 2497 Comm: ping Tainted: G W 4.15.0-rc7+ #5 [ 178.319413] Hardware name: FOXCONN R2-1221R-A4/C2U4N_MB, BIOS G31FB18A 03/31/2017 [ 178.326887] pstate: 60400005 (nZCv daif +PAN -UAO) [ 178.331685] pc : __netif_receive_skb_core+0x49c/0xac8 [ 178.336728] lr : __netif_receive_skb+0x28/0x78 [ 178.341161] sp : ffff00002344b750 [ 178.344465] x29: ffff00002344b750 x28: ffff810fbdfd0580 [ 178.349769] x27: 0000000000000000 x26: ffff000009378000 [...] [ 178.418715] x1 : 0000000000000054 x0 : 0000000000000000 [ 178.424020] Process ping (pid: 2497, stack limit = 0x000000009f0a3ff4) [ 178.430537] Call trace: [ 178.432976] __netif_receive_skb_core+0x49c/0xac8 [ 178.437670] __netif_receive_skb+0x28/0x78 [ 178.441757] process_backlog+0x9c/0x160 [ 178.445584] net_rx_action+0x2f8/0x3f0 [...] Reason is that sch_ingress and sch_clsact are doing mini_qdisc_pair_init() which sets up miniq pointers to cpu_{b,q}stats from the underlying qdisc. Problem is that this cannot work since they are actually set up right after the qdisc ->init() callback in qdisc_create(), so first packet going into sch_handle_ingress() tries to call mini_qdisc_bstats_cpu_update() and we therefore panic. In order to fix this, allocation of {b,q}stats needs to happen before we call into ->init(). In net-next, there's already such option through commit d59f5ffa59 ("net: sched: a dflt qdisc may be used with per cpu stats"). However, the bug needs to be fixed in net still for 4.15. Thus, include these bits to reduce any merge churn and reuse the static_flags field to set TCQ_F_CPUSTATS, and remove the allocation from qdisc_create() since there is no other user left. Prashant Bhole ran into the same issue but for net-next, thus adding him below as well as co-author. Same issue was also reported by Sandipan Das when using bcc. Fixes: 46209401f8 ("net: core: introduce mini_Qdisc and eliminate usage of tp->q for clsact fastpath") Reference: https://lists.iovisor.org/pipermail/iovisor-dev/2018-January/001190.html Reported-by: Sandipan Das <sandipan@linux.vnet.ibm.com> Co-authored-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp> Co-authored-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-01-16 15:02:36 -05:00
..
acpi	Merge branch 'acpi-ec' into acpi	2017-11-30 13:37:29 +01:00
asm-generic	Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-12-23 11:53:04 -08:00
clocksource	arm64 updates for 4.15	2017-11-15 10:56:56 -08:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2018-01-05 12:10:06 -08:00
drm	drm: rework delayed connector cleanup in connector_iter	2017-12-13 22:59:00 +01:00
dt-bindings	fixes/cleanups for rc1, non-desktop flags for VR	2017-11-23 21:04:56 -10:00
keys
kvm	KVM: arm/arm64: timer: Don't set irq as forwarded if no usable GIC	2017-12-18 10:53:23 +01:00
linux	netlink: extack: avoid parenthesized string constant warning	2018-01-15 15:15:23 -05:00
math-emu
media	media updates for v4.15-rc1	2017-11-15 20:30:12 -08:00
memory
misc
net	net, sched: fix panic when updating miniq {b,q}stats	2018-01-16 15:02:36 -05:00
pcmcia
ras
rdma	Updates for 4.15 kernel merge window	2017-11-15 14:54:53 -08:00
scsi	scsi: libsas: align sata_device's rps_resp on a cacheline	2017-11-21 23:06:32 -05:00
soc	We have two changes to the core framework this time around. The first being a	2017-11-17 20:04:24 -08:00
sound	ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization	2017-11-22 12:34:56 +01:00
target	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2017-11-24 19:19:20 -10:00
trace	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-12-28 23:20:21 -08:00
uapi	Revert "openvswitch: Add erspan tunnel support."	2018-01-15 14:33:16 -05:00
video	fbdev changes for v4.15:	2017-11-20 21:50:24 -10:00
xen	xen: fixes for 4.15-rc5	2017-12-22 12:30:10 -08:00