[PATCH AUTOSEL 5.3 49/99] netfilter: conntrack: avoid possible false sharing

public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed

From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>,
	syzbot <syzkaller@googlegroups.com>,
	Jozsef Kadlecsik <kadlec@netfilter.org>,
	Florian Westphal <fw@strlen.de>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Jakub Kicinski <jakub.kicinski@netronome.com>,
	Sasha Levin <sashal@kernel.org>,
	netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.3 49/99] netfilter: conntrack: avoid possible false sharing
Date: Sat, 26 Oct 2019 09:15:10 -0400	[thread overview]
Message-ID: <20191026131600.2507-49-sashal@kernel.org> (raw)
In-Reply-To: <20191026131600.2507-1-sashal@kernel.org>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit e37542ba111f3974dc622ae0a21c1787318de500 ]

As hinted by KCSAN, we need at least one READ_ONCE()
to prevent a compiler optimization.

More details on :
https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance

sysbot report :
BUG: KCSAN: data-race in __nf_ct_refresh_acct / __nf_ct_refresh_acct

read to 0xffff888123eb4f08 of 4 bytes by interrupt on cpu 0:
 __nf_ct_refresh_acct+0xd4/0x1b0 net/netfilter/nf_conntrack_core.c:1796
 nf_ct_refresh_acct include/net/netfilter/nf_conntrack.h:201 [inline]
 nf_conntrack_tcp_packet+0xd40/0x3390 net/netfilter/nf_conntrack_proto_tcp.c:1161
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1633 [inline]
 nf_conntrack_in+0x410/0xaa0 net/netfilter/nf_conntrack_core.c:1727
 ipv4_conntrack_in+0x27/0x40 net/netfilter/nf_conntrack_proto.c:178
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_slow+0x83/0x160 net/netfilter/core.c:512
 nf_hook include/linux/netfilter.h:260 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip_rcv+0x12f/0x1a0 net/ipv4/ip_input.c:523
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5004
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5118
 netif_receive_skb_internal+0x59/0x190 net/core/dev.c:5208
 napi_skb_finish net/core/dev.c:5671 [inline]
 napi_gro_receive+0x28f/0x330 net/core/dev.c:5704
 receive_buf+0x284/0x30b0 drivers/net/virtio_net.c:1061
 virtnet_receive drivers/net/virtio_net.c:1323 [inline]
 virtnet_poll+0x436/0x7d0 drivers/net/virtio_net.c:1428
 napi_poll net/core/dev.c:6352 [inline]
 net_rx_action+0x3ae/0xa50 net/core/dev.c:6418
 __do_softirq+0x115/0x33f kernel/softirq.c:292

write to 0xffff888123eb4f08 of 4 bytes by task 7191 on cpu 1:
 __nf_ct_refresh_acct+0xfb/0x1b0 net/netfilter/nf_conntrack_core.c:1797
 nf_ct_refresh_acct include/net/netfilter/nf_conntrack.h:201 [inline]
 nf_conntrack_tcp_packet+0xd40/0x3390 net/netfilter/nf_conntrack_proto_tcp.c:1161
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1633 [inline]
 nf_conntrack_in+0x410/0xaa0 net/netfilter/nf_conntrack_core.c:1727
 ipv4_conntrack_local+0xbe/0x130 net/netfilter/nf_conntrack_proto.c:200
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_slow+0x83/0x160 net/netfilter/core.c:512
 nf_hook include/linux/netfilter.h:260 [inline]
 __ip_local_out+0x1f7/0x2b0 net/ipv4/ip_output.c:114
 ip_local_out+0x31/0x90 net/ipv4/ip_output.c:123
 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x45/0x60 include/net/ip.h:236
 __tcp_transmit_skb+0xdeb/0x1cd0 net/ipv4/tcp_output.c:1158
 __tcp_send_ack+0x246/0x300 net/ipv4/tcp_output.c:3685
 tcp_send_ack+0x34/0x40 net/ipv4/tcp_output.c:3691
 tcp_cleanup_rbuf+0x130/0x360 net/ipv4/tcp.c:1575

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 7191 Comm: syz-fuzzer Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: cc16921351d8 ("netfilter: conntrack: avoid same-timeout update")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 81a8ef42b88d3..56b1cf82ed3aa 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1793,8 +1793,8 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
 	if (nf_ct_is_confirmed(ct))
 		extra_jiffies += nfct_time_stamp;
 
-	if (ct->timeout != extra_jiffies)
-		ct->timeout = extra_jiffies;
+	if (READ_ONCE(ct->timeout) != extra_jiffies)
+		WRITE_ONCE(ct->timeout, extra_jiffies);
 acct:
 	if (do_acct)
 		nf_ct_acct_update(ct, ctinfo, skb->len);
-- 
2.20.1

next prev parent reply	other threads:[~2019-10-26 13:34 UTC|newest]

Thread overview: 99+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-26 13:14 [PATCH AUTOSEL 5.3 01/99] tools: bpf: Use !building_out_of_srctree to determine srctree Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 02/99] iommu/arm-smmu: Free context bitmap in the err path of arm_smmu_init_domain_context Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 03/99] iommu/io-pgtable-arm: Correct Mali attributes Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 04/99] iommu/io-pgtable-arm: Support all Mali configurations Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 05/99] rt2x00: initialize last_reset Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 06/99] ACPI: HMAT: ACPI_HMAT_MEMORY_PD_VALID is deprecated since ACPI-6.3 Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 07/99] mac80211_hwsim: fix incorrect dev_alloc_name failure goto Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 08/99] nvme: fix possible deadlock when nvme_update_formats fails Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 09/99] nvme: retain split access workaround for capability reads Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 10/99] net: dsa: b53: Do not clear existing mirrored port mask Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 11/99] net: stmmac: selftests: Check if filtering is available before running Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 12/99] net: stmmac: gmac4+: Not all Unicast addresses may be available Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 13/99] net: stmmac: selftests: Fix L2 Hash Filter test Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 14/99] ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 15/99] ALSA: hdac: clear link output stream mapping Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 16/99] rxrpc: Fix call ref leak Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 17/99] rxrpc: Fix trace-after-put looking at the put peer record Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 18/99] rxrpc: Fix trace-after-put looking at the put connection record Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 19/99] rxrpc: Fix trace-after-put looking at the put call record Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 20/99] rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 21/99] nl80211: fix memory leak in nl80211_get_ftm_responder_stats Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 22/99] cfg80211: fix a bunch of RCU issues in multi-bssid code Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 23/99] mac80211: accept deauth frames in IBSS mode Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 24/99] mac80211: fix scan when operating on DFS channels in ETSI domains Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 25/99] llc: fix sk_buff leak in llc_sap_state_process() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 26/99] llc: fix sk_buff leak in llc_conn_service() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 27/99] llc: fix another potential sk_buff leak in llc_ui_sendmsg() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 28/99] llc: fix sk_buff refcounting in llc_conn_state_process() Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 29/99] selftests/bpf: Set rp_filter in test_flow_dissector Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 30/99] selftests/bpf: More compatible nc options in test_lwt_ip_encap Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 31/99] net_sched: fix backward compatibility for TCA_KIND Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 32/99] net_sched: fix backward compatibility for TCA_ACT_KIND Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 33/99] NFC: pn533: fix use-after-free and memleaks Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 34/99] ip6erspan: remove the incorrect mtu limit for ip6erspan Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 35/99] iwlwifi: mvm: fix race in sync rx queue notification Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 36/99] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 37/99] iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init Sasha Levin
2019-10-26 13:14 ` [PATCH AUTOSEL 5.3 38/99] iwlwifi: exclude GEO SAR support for 3168 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 39/99] drm/amdgpu/powerplay: fix typo in mvdd table setup Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 40/99] net: stmmac: fix length of PTP clock's name string Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 41/99] net: stmmac: fix disabling flexible PPS output Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 42/99] bonding: fix potential NULL deref in bond_update_slave_arr Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 43/99] sctp: add chunks to sk_backlog when the newsk sk_socket is not set Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 44/99] s390/qeth: Fix error handling during VNICC initialization Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 45/99] s390/qeth: Fix initialization of vnicc cmd masks during set online Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 46/99] act_mirred: Fix mirred_init_module error handling Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 47/99] net: usb: qmi_wwan: add Telit 0x1050 composition Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 48/99] netns: fix NLM_F_ECHO mechanism for RTM_NEWNSID Sasha Levin
2019-10-26 13:15 ` Sasha Levin [this message]
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 50/99] tun: remove possible false sharing in tun_flow_update() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 51/99] net: avoid possible false sharing in sk_leave_memory_pressure() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 52/99] net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 53/99] net/smc: fix SMCD link group creation with VLAN id Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 54/99] net/smc: receive returns without data Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 55/99] net/smc: receive pending data after RCV_SHUTDOWN Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 56/99] drm/msm/dsi: Implement reset correctly Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 57/99] vhost/test: stop device before reset Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 58/99] net/ibmvnic: Fix EOI when running in XIVE mode Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 59/99] netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 60/99] ath10k: fix latency issue for QCA988x Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 61/99] drm/ttm: fix busy reference in ttm_mem_evict_first Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 62/99] drm/ttm: fix handling in ttm_bo_add_mem_to_lru Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 63/99] platform/x86: i2c-multi-instantiate: Fail the probe if no IRQ provided Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 64/99] hrtimer: Annotate lockless access to timer->base Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 65/99] nvme-pci: Free tagset if no IO queues Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 66/99] nvme: Prevent resets during paused controller state Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 67/99] xtensa: fix {get,put}_user() for 64bit values Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 68/99] firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 69/99] net: aquantia: temperature retrieval fix Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 70/99] net: aquantia: do not pass lro session with invalid tcp checksum Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 71/99] net: aquantia: correctly handle macvlan and multicast coexistence Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 72/99] arm64: hibernate: check pgd table allocation Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 73/99] iommu/amd: Fix incorrect PASID decoding from event log Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 74/99] nvmet-loop: fix possible leakage during error flow Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 75/99] nvme-tcp: " Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 76/99] rbd: cancel lock_dwork if the wait is interrupted Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 77/99] sparc64: disable fast-GUP due to unexplained oopses Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 78/99] net: i82596: fix dma_alloc_attr for sni_82596 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 79/99] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 80/99] net: usb: sr9800: fix uninitialized local variable Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 81/99] md/raid0: fix warning message for parameter default_layout Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 82/99] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 83/99] stop_machine: Avoid potential race behaviour Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 84/99] usb: hso: obey DMA rules in tiocmget Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 85/99] dpaa2-eth: add irq for the dpmac connect/disconnect event Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 86/99] net: stmmac: fix argument to stmmac_pcs_ctrl_ane() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 87/99] net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 88/99] net: phy: micrel: Update KSZ87xx PHY name Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 89/99] x86/hyperv: Set pv_info.name to "Hyper-V" Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 90/99] net: bcmgenet: don't set phydev->link from MAC Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 91/99] net: phy: bcm7xxx: define soft_reset for 40nm EPHY Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 92/99] net: bcmgenet: reset 40nm EPHY on energy detect Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 93/99] net: usb: lan78xx: Connect PHY before registering MAC Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 94/99] scripts/gdb: fix lx-dmesg when CONFIG_PRINTK_CALLER is set Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 95/99] ocfs2: fix error handling in ocfs2_setattr() Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 96/99] mm/gup_benchmark: add a missing "w" to getopt string Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 97/99] scripts/gdb: fix debugging modules on s390 Sasha Levin
2019-10-26 13:15 ` [PATCH AUTOSEL 5.3 98/99] net: hns3: fix mis-counting IRQ vector numbers issue Sasha Levin
2019-10-26 13:16 ` [PATCH AUTOSEL 5.3 99/99] net: aquantia: add an error handling in aq_nic_set_multicast_list Sasha Levin

find likely ancestor, descendant, or conflicting patches for this message:
( dfblob:81a8ef42b88d dfblob:56b1cf82ed3a )
 OR (
bs:"[PATCH AUTOSEL 5.3 49/99] netfilter: conntrack: avoid possible false sharing" )
	(help)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191026131600.2507-49-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=edumazet@google.com \
    --cc=fw@strlen.de \
    --cc=jakub.kicinski@netronome.com \
    --cc=kadlec@netfilter.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    --cc=syzkaller@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox