Files
linux/include/linux
Eric Dumazet 779807c74a hrtimer: Annotate lockless access to timer->state
commit 56144737e6 upstream.

syzbot reported various data-race caused by hrtimer_is_queued() reading
timer->state. A READ_ONCE() is required there to silence the warning.

Also add the corresponding WRITE_ONCE() when timer->state is set.

In remove_hrtimer() the hrtimer_is_queued() helper is open coded to avoid
loading timer->state twice.

KCSAN reported these cases:

BUG: KCSAN: data-race in __remove_hrtimer / tcp_pacing_check

write to 0xffff8880b2a7d388 of 1 bytes by interrupt on cpu 0:
 __remove_hrtimer+0x52/0x130 kernel/time/hrtimer.c:991
 __run_hrtimer kernel/time/hrtimer.c:1496 [inline]
 __hrtimer_run_queues+0x250/0x600 kernel/time/hrtimer.c:1576
 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1593
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

read to 0xffff8880b2a7d388 of 1 bytes by task 24652 on cpu 1:
 tcp_pacing_check net/ipv4/tcp_output.c:2235 [inline]
 tcp_pacing_check+0xba/0x130 net/ipv4/tcp_output.c:2225
 tcp_xmit_retransmit_queue+0x32c/0x5a0 net/ipv4/tcp_output.c:3044
 tcp_xmit_recovery+0x7c/0x120 net/ipv4/tcp_input.c:3558
 tcp_ack+0x17b6/0x3170 net/ipv4/tcp_input.c:3717
 tcp_rcv_established+0x37e/0xf50 net/ipv4/tcp_input.c:5696
 tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561
 sk_backlog_rcv include/net/sock.h:945 [inline]
 __release_sock+0x135/0x1e0 net/core/sock.c:2435
 release_sock+0x61/0x160 net/core/sock.c:2951
 sk_stream_wait_memory+0x3d7/0x7c0 net/core/stream.c:145
 tcp_sendmsg_locked+0xb47/0x1f30 net/ipv4/tcp.c:1393
 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1434
 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657

BUG: KCSAN: data-race in __remove_hrtimer / __tcp_ack_snd_check

write to 0xffff8880a3a65588 of 1 bytes by interrupt on cpu 0:
 __remove_hrtimer+0x52/0x130 kernel/time/hrtimer.c:991
 __run_hrtimer kernel/time/hrtimer.c:1496 [inline]
 __hrtimer_run_queues+0x250/0x600 kernel/time/hrtimer.c:1576
 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1593
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830

read to 0xffff8880a3a65588 of 1 bytes by task 22891 on cpu 1:
 __tcp_ack_snd_check+0x415/0x4f0 net/ipv4/tcp_input.c:5265
 tcp_ack_snd_check net/ipv4/tcp_input.c:5287 [inline]
 tcp_rcv_established+0x750/0xf50 net/ipv4/tcp_input.c:5708
 tcp_v4_do_rcv+0x381/0x4e0 net/ipv4/tcp_ipv4.c:1561
 sk_backlog_rcv include/net/sock.h:945 [inline]
 __release_sock+0x135/0x1e0 net/core/sock.c:2435
 release_sock+0x61/0x160 net/core/sock.c:2951
 sk_stream_wait_memory+0x3d7/0x7c0 net/core/stream.c:145
 tcp_sendmsg_locked+0xb47/0x1f30 net/ipv4/tcp.c:1393
 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1434
 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 __sys_sendto+0x21f/0x320 net/socket.c:1952
 __do_sys_sendto net/socket.c:1964 [inline]
 __se_sys_sendto net/socket.c:1960 [inline]
 __x64_sys_sendto+0x89/0xb0 net/socket.c:1960
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 24652 Comm: syz-executor.3 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

[ tglx: Added comments ]

Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20191106174804.74723-1-edumazet@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:13:32 +01:00
..
2019-12-13 08:51:18 +01:00
2019-12-17 20:35:45 +01:00
2018-05-26 09:16:44 +02:00
2018-06-15 18:10:01 -03:00
2017-06-08 18:52:36 -07:00
2019-10-05 13:10:03 +02:00
2019-07-03 13:14:48 +02:00
2018-05-09 17:25:13 +02:00
2017-11-15 18:21:04 -08:00
2018-06-15 18:10:01 -03:00
2018-06-19 10:06:29 -07:00
2018-03-26 15:09:38 +02:00
2018-08-22 10:52:48 -07:00
2019-08-09 17:52:28 +02:00
2017-08-24 13:23:03 -07:00
2018-01-01 12:40:27 -07:00
2019-11-24 08:19:14 +01:00
2017-08-07 17:22:14 +02:00
2018-07-12 10:04:29 -04:00
2017-11-13 01:41:20 +01:00
2018-07-27 09:57:23 +10:00
2019-05-31 06:46:18 -07:00
2018-06-28 20:32:51 +09:00
2019-10-17 13:45:42 -07:00
2018-03-26 08:53:43 -06:00
2018-08-08 11:06:20 +02:00
2018-06-22 13:43:27 +09:00
2019-12-13 08:52:43 +01:00
2018-04-11 10:28:38 -07:00
2017-11-15 18:21:01 -08:00
2018-07-12 21:35:28 +02:00
2017-12-01 13:09:40 -08:00
2018-04-12 09:41:19 -07:00
2017-08-28 20:51:22 +02:00
2018-06-05 08:50:16 -04:00
2018-06-07 17:34:35 -07:00
2018-04-11 10:28:32 -07:00
2019-12-31 16:35:38 +01:00
2018-06-07 17:34:39 -07:00
2018-03-26 13:14:43 -04:00
2018-03-26 13:14:43 -04:00
2018-08-22 10:52:45 -07:00
2018-01-28 22:17:24 -05:00
2017-07-25 18:05:25 +02:00
2018-01-08 08:22:45 -06:00
2018-07-10 17:22:35 +02:00
2018-01-08 08:22:45 -06:00
2018-06-07 17:34:36 -07:00
2018-04-11 10:28:39 -07:00
2018-01-31 17:18:37 -08:00
2017-11-09 10:23:28 +01:00
2018-07-19 11:34:23 +01:00
2018-07-25 13:41:22 -07:00
2017-11-17 16:10:04 -08:00
2018-07-21 10:43:12 -05:00
2017-11-13 01:33:48 +01:00
2017-12-16 02:05:48 +01:00
2018-08-22 10:52:46 -07:00
2018-05-31 00:13:56 +08:00
2019-06-11 12:20:52 +02:00
2018-07-20 01:11:45 +02:00
2018-08-02 17:33:06 -04:00
2018-05-11 17:28:45 -07:00
2018-05-11 17:28:45 -07:00
2018-08-02 17:16:05 +02:00
2018-03-01 08:33:05 -07:00
2017-11-07 12:22:21 +01:00
2018-06-29 08:48:06 -06:00
2018-06-07 17:34:35 -07:00
2018-07-07 17:25:23 +02:00
2018-05-03 15:55:23 -07:00
2018-08-16 12:14:42 -07:00
2018-01-15 12:07:46 -08:00
2019-04-17 08:38:45 +02:00
2018-06-20 11:35:56 +02:00
2018-02-06 18:32:47 -08:00
2018-11-13 11:08:51 -08:00
2019-06-17 19:51:56 +02:00
2018-02-06 18:32:44 -08:00
2017-12-20 09:53:54 -07:00
2018-05-14 09:51:34 -04:00
2017-08-15 09:02:07 -07:00
2017-08-15 09:02:08 -07:00