[PATCH net v2] net: gro_cells: prevent enabling threaded NAPI on gro_cells

[Naman Gulati <namangulati@google.com>]

gro_cells allocates a per-CPU struct gro_cell with per-CPU queues
(cell->napi_skbs), per-CPU local_lock_t (cell->bh_lock), and per-CPU
napi_struct (cell->napi). On !CONFIG_PREEMPT_RT, local_lock_t only
provides lockdep annotation (and is a complete no-op when
CONFIG_DEBUG_LOCK_ALLOC is disabled), relying on per-CPU locality and
disabled BH context for mutual exclusion; it does not provide cross-CPU
synchronization.

When threaded NAPI is enabled on a device backed by gro_cells (e.g.
gre0, vxlan, geneve) via sysfs, unbound kernel threads are created for
each per-CPU NAPI. When gro_cells_receive() on CPU A enqueues a packet
to cell_A and calls napi_schedule(&cell_A->napi) while holding
cell_A->bh_lock, the woken kthread can run concurrently on remote CPU B.

When CPU B runs gro_cell_poll(&cell_A->napi) and calls
__local_lock_nested_bh(&cell_A->bh_lock), lockdep detects that the lock
is already held by CPU A's task and triggers a warning:

  WARNING: CPU: 1 PID: 377 at net/core/gro_cells.c:66 gro_cell_poll
  DEBUG_LOCKS_WARN_ON(l->owner)
  CPU: 1 UID: 0 PID: 377 Comm: napi/gre0-0 Not tainted 7.3.0-rc2
  Call Trace:
   <TASK>
   __local_lock_nested_bh include/linux/local_lock_internal.h:92
   gro_cell_poll+0x5aa/0x6c0 net/core/gro_cells.c:66
   napi_threaded_poll+0x39b/0x600 net/core/dev.c:7048
   kthread+0x71e/0x870 kernel/kthread.c:464
   ret_from_fork+0x5d/0x90 arch/x86/kernel/process.c:167
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:264
   </TASK>

On !CONFIG_PREEMPT_RT kernels without lockdep, concurrent execution of
__skb_queue_tail() on CPU A and __skb_dequeue() on CPU B without
cross-CPU locks leads to silent queue corruption.

Virtual per-CPU NAPIs (like gro_cells) cannot support unbound threaded
NAPI or busypolling. For NAPIs that set NAPI_STATE_NO_BUSY_POLL,
napi_hash_add() skips adding its NAPIs to napi_hash and assigning a
valid NAPI ID, which already prevents enabling threaded NAPI on them via
Netlink.

Check NAPI_STATE_NO_BUSY_POLL in modify_napi_threaded(), and fail early
with -EOPNOTSUPP when trying to enable threaded NAPI via sysfs on
netdevs where all NAPIs have NAPI_STATE_NO_BUSY_POLL set. A more
fundamental check like napi_id_valid(napi->napi_id) can potentially
break userspace that tries to enable threaded napi on netdevs that are
down. This check brings threaded napi control via sysfs closer to
netlink.

Fixes: 25718fdcbdd2 ("net: gro_cells: Use nested-BH locking for gro_cell")
Fixes: 29863d41bb6e ("net: implement threaded-able napi poll loop support")
Reported-by: syzbot+f0661448aa9511ce744a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6aad6d7b.0c43d342.320d00.0001.GAE@google.com
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Naman Gulati <namangulati@google.com>

---
v2:
  - Check NAPI_STATE_NO_BUSY_POLL in modify_napi_threaded() instead of
    adding NAPI_STATE_NO_THREADED (Jakub).
  - v1: https://lore.kernel.org/all/20260918173413.3222413-1-namangulati@google.com/
---
 net/core/net-sysfs.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 352173df7578..286c7b4139df 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -743,17 +743,17 @@ static ssize_t threaded_show(struct device *dev,
 
 static int modify_napi_threaded(struct net_device *dev, unsigned long val)
 {
-	int ret;
-
-	if (list_empty(&dev->napi_list))
-		return -EOPNOTSUPP;
+	struct napi_struct *napi;
 
 	if (val != 0 && val != 1)
 		return -EOPNOTSUPP;
 
-	ret = netif_set_threaded(dev, val);
+	list_for_each_entry(napi, &dev->napi_list, dev_list) {
+		if (!test_bit(NAPI_STATE_NO_BUSY_POLL, &napi->state))
+			return netif_set_threaded(dev, val);
+	}
 
-	return ret;
+	return -EOPNOTSUPP;
 }
 
 static ssize_t threaded_store(struct device *dev,
-- 
2.56.0.rc1.315.gc6ed9934b7-goog