[BUG] WARNING in nsim_vlan_rx_add_vid

[l1za0.sec@gmail.com]

From: Haocheng Yu <l1za0.sec@gmail.com>

Hi,

We found a kernel warning in nsim_vlan_rx_add_vid() while fuzzing Linux
with a modified version of syzkaller. We couldn't find a report of the 
same issue on syzbot. We are investigating the root cause and trying to 
develop a fix. Could you let us know whether this issue warrants a fix?
 

The warning occurs on Linux 7.3.0-02415-g7be4bc52fd9e (#4,
PREEMPT(full)) at drivers/net/netdevsim/netdev.c:569. The kernel then
panics because panic_on_warn is set. The report also shows an existing
SOFTLOCKUP taint; the relationship to this warning is not yet established.

Relevant report excerpt:

  WARNING: drivers/net/netdevsim/netdev.c:569 at
  nsim_vlan_rx_add_vid+0xb5/0x120

Relevant stack trace (inline frames included):

  nsim_vlan_rx_add_vid (drivers/net/netdevsim/netdev.c:569)
  vlan_add_rx_filter_info (net/8021q/vlan_core.c:211)
  vlan_filter_push_vids (net/8021q/vlan_core.c:262)
  vlan_device_event (net/8021q/vlan.c:483)
  notifier_call_chain (kernel/notifier.c:85)
  call_netdevice_notifiers_info (net/core/dev.c:2260)
  __netdev_update_features (net/core/dev.c:11179)
  ethtool_set_features (net/ethtool/ioctl.c:155)
  dev_ethtool_locked (net/ethtool/ioctl.c:3488)
  dev_ethtool (net/ethtool/ioctl.c:3669)
  dev_ioctl (net/core/dev_ioctl.c:745)
  sock_do_ioctl (net/socket.c:1339)
  sock_ioctl (net/socket.c:1446)
  __x64_sys_ioctl (fs/ioctl.c:583)

The syzkaller reproducer opens CAN J1939 sockets and issues two
SIOCETHTOOL ioctls with ETHTOOL_SFEATURES requests for netdevsim0.
The warning is reached through the VLAN receive-filter update path
when network device features are updated. The root cause has not yet
been confirmed.

Full syzkaller reproducer:

# {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x25a, 0xfffffffd}, {0xffff8000, 0x2}]}})
socket$can_j1939(0x1d, 0x2, 0x7)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x25a, 0x1}, {0xffff8000, 0xffffffff}]}})

Best regards,
Haocheng Yu