Eric Dumazet cd3bcb44ee net: add READ_ONCE() annotation in __skb_wait_for_more_packets() ... [ Upstream commit 7c422d0ce9 ] __skb_wait_for_more_packets() can be called while other cpus can feed packets to the socket receive queue. KCSAN reported : BUG: KCSAN: data-race in __skb_wait_for_more_packets / __udp_enqueue_schedule_skb write to 0xffff888102e40b58 of 8 bytes by interrupt on cpu 0: __skb_insert include/linux/skbuff.h:1852 [inline] __skb_queue_before include/linux/skbuff.h:1958 [inline] __skb_queue_tail include/linux/skbuff.h:1991 [inline] __udp_enqueue_schedule_skb+0x2d7/0x410 net/ipv4/udp.c:1470 __udp_queue_rcv_skb net/ipv4/udp.c:1940 [inline] udp_queue_rcv_one_skb+0x7bd/0xc70 net/ipv4/udp.c:2057 udp_queue_rcv_skb+0xb5/0x400 net/ipv4/udp.c:2074 udp_unicast_rcv_skb.isra.0+0x7e/0x1c0 net/ipv4/udp.c:2233 __udp4_lib_rcv+0xa44/0x17c0 net/ipv4/udp.c:2300 udp_rcv+0x2b/0x40 net/ipv4/udp.c:2470 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:442 [inline] ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124 process_backlog+0x1d3/0x420 net/core/dev.c:5955 read to 0xffff888102e40b58 of 8 bytes by task 13035 on cpu 1: __skb_wait_for_more_packets+0xfa/0x320 net/core/datagram.c:100 __skb_recv_udp+0x374/0x500 net/ipv4/udp.c:1683 udp_recvmsg+0xe1/0xb10 net/ipv4/udp.c:1712 inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838 sock_recvmsg_nosec+0x5c/0x70 net/socket.c:871 ___sys_recvmsg+0x1a0/0x3e0 net/socket.c:2480 do_recvmmsg+0x19a/0x5c0 net/socket.c:2601 __sys_recvmmsg+0x1ef/0x200 net/socket.c:2680 __do_sys_recvmmsg net/socket.c:2703 [inline] __se_sys_recvmmsg net/socket.c:2696 [inline] __x64_sys_recvmmsg+0x89/0xb0 net/socket.c:2696 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 13035 Comm: syz-executor.3 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-10 11:27:49 +01:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-07-06 12:32:12 +02:00
9p	9p: Transport error uninitialized	2019-10-11 18:21:12 +02:00
802
8021q	vlan: disable SIOCSHWTSTAMP in container	2019-05-16 19:41:30 +02:00
appletalk	appletalk: enforce CAP_NET_RAW for raw sockets	2019-10-05 13:09:31 +02:00
atm	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-10-05 13:09:32 +02:00
batman-adv	batman-adv: Avoid free/alloc race when handling OGM buffer	2019-11-06 13:06:22 +01:00
bluetooth	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	net: bpfilter: use get_pid_task instead of pid_task	2018-10-17 22:03:40 -07:00
bridge	netfilter: ebtables: Fix argument order to ADD_COUNTER	2019-09-21 07:16:54 +02:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
can	can: gw: Fix error path of cgw_module_init	2019-08-29 08:28:30 +02:00
ceph	libceph: fix PG split vs OSD (re)connect race	2019-08-29 08:28:50 +02:00
core	net: add READ_ONCE() annotation in __skb_wait_for_more_packets()	2019-11-10 11:27:49 +01:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	inet: stop leaking jiffies on the wire	2019-11-10 11:27:37 +01:00
decnet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
dns_resolver	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
dsa	net: dsa: Check existence of .port_mdb_add callback before calling it	2019-08-25 10:48:03 +02:00
ethernet	net: Convert GRO SKB handling to list_head.	2018-06-26 11:33:04 +09:00
hsr	net/hsr: fix possible crash in add_timer()	2019-03-19 13:12:38 +01:00
ieee802154	ieee802154: enforce CAP_NET_RAW for raw sockets	2019-10-05 13:09:32 +02:00
ife
ipv4	net: use skb_queue_empty_lockless() in busy poll contexts	2019-11-10 11:27:49 +01:00
ipv6	net: annotate accesses to sk->sk_incoming_cpu	2019-11-10 11:27:38 +01:00
iucv	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: fix leaks in key_pol_get_resp and dump_sp.	2019-07-26 09:14:01 +02:00
l2tp	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-08-09 17:52:34 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	llc: fix sk_buff leak in llc_conn_service()	2019-11-06 13:06:23 +01:00
mac80211	mac80211: Reject malformed SSID elements	2019-10-29 09:19:53 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-10 07:17:19 +01:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	netfilter: ipset: Make invalid MAC address checks consistent	2019-11-06 13:05:23 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-10 07:17:18 +01:00
netlink	genetlink: Fix a memory leak on error path	2019-04-03 06:26:15 +02:00
netrom	netrom: hold sock when setting skb->destructor	2019-07-28 08:29:27 +02:00
nfc	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	netns: fix GFP flags in rtnl_net_notifyid()	2019-11-10 11:27:42 +01:00
packet	net/packet: fix race in tpacket_snd()	2019-08-25 10:48:04 +02:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
psample	net: sched: act_sample: fix psample group handling on overwrite	2019-09-10 10:33:38 +01:00
qrtr	net: qrtr: Stop rx_worker before freeing node	2019-10-05 13:09:27 +02:00
rds	net/rds: Fix error handling in rds_ib_add_one()	2019-10-07 18:57:24 +02:00
rfkill	Here are quite a large number of fixes, notably:	2018-09-03 22:12:02 -07:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:59:00 +02:00
rxrpc	rxrpc: Fix trace-after-put looking at the put peer record	2019-11-06 13:06:24 +01:00
sched	sch_netem: fix rcu splat in netem_enqueue()	2019-11-06 13:06:27 +01:00
sctp	net: use skb_queue_empty_lockless() in busy poll contexts	2019-11-10 11:27:49 +01:00
smc	net/smc: make sure EPOLLOUT is raised	2019-09-06 10:22:06 +02:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	net :sunrpc :clnt :Fix xps refcount imbalance on the error path	2019-07-14 08:11:15 +02:00
switchdev
tipc	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
tls	net: tls, fix sk_write_space NULL write when tx disabled	2019-09-06 10:22:04 +02:00
unix	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
vmw_vsock	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	nl80211: fix validation of mesh path nexthop	2019-11-06 13:06:19 +01:00
x25	net/x25: fix a race in x25_bind()	2019-03-19 13:12:40 +01:00
xdp	xdp: unpin xdp umem pages in error path	2019-09-21 07:16:57 +02:00
xfrm	ipsec: select crypto ciphers for xfrm_algo	2019-07-26 09:14:10 +02:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	net: socket: set sock->sk to NULL after calling proto_ops::release()	2019-03-10 07:17:18 +01:00
sysctl_net.c