* Re: [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu
2025-06-27 11:46 [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu Eric Dumazet
@ 2025-06-27 12:35 ` Neal Cardwell
2025-06-27 13:33 ` Nikolay Aleksandrov
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Neal Cardwell @ 2025-06-27 12:35 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
Kuniyuki Iwashima, David Ahern, netdev, eric.dumazet,
syzbot+f02fb9e43bd85c6c66ae, Petr Machata, Roopa Prabhu,
Nikolay Aleksandrov, Benjamin Poirier, Ido Schimmel
On Fri, Jun 27, 2025 at 7:47 AM Eric Dumazet <edumazet@google.com> wrote:
>
> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
>
> Add guard(rcu)() to fix this in a concise way.
>
> WARNING: CPU: 0 PID: 0 at net/ipv4/ipmr.c:2302 ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302
> Call Trace:
> <IRQ>
> igmp_send_report+0x89e/0xdb0 net/ipv4/igmp.c:799
> igmp_timer_expire+0x204/0x510 net/ipv4/igmp.c:-1
> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
> expire_timers kernel/time/timer.c:1798 [inline]
> __run_timers kernel/time/timer.c:2372 [inline]
> __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
> run_timer_base kernel/time/timer.c:2393 [inline]
> run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> __do_softirq kernel/softirq.c:613 [inline]
> invoke_softirq kernel/softirq.c:453 [inline]
> __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
> irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
> instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
> sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
>
> Fixes: 35bec72a24ac ("net: ipv4: Add ip_mr_output()")
> Reported-by: syzbot+f02fb9e43bd85c6c66ae@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/685e841a.a00a0220.129264.0002.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Petr Machata <petrm@nvidia.com>
> Cc: Roopa Prabhu <roopa@nvidia.com>
> Cc: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: Benjamin Poirier <bpoirier@nvidia.com>
> Cc: Ido Schimmel <idosch@nvidia.com>
> ---
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Thanks, Eric!
neal
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu
2025-06-27 11:46 [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu Eric Dumazet
2025-06-27 12:35 ` Neal Cardwell
@ 2025-06-27 13:33 ` Nikolay Aleksandrov
2025-06-27 14:48 ` Petr Machata
2025-06-28 9:50 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Nikolay Aleksandrov @ 2025-06-27 13:33 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Kuniyuki Iwashima, David Ahern, netdev,
eric.dumazet, syzbot+f02fb9e43bd85c6c66ae, Petr Machata,
Roopa Prabhu, Benjamin Poirier, Ido Schimmel
On 6/27/25 14:46, Eric Dumazet wrote:
> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
>
> Add guard(rcu)() to fix this in a concise way.
>
> WARNING: CPU: 0 PID: 0 at net/ipv4/ipmr.c:2302 ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302
> Call Trace:
> <IRQ>
> igmp_send_report+0x89e/0xdb0 net/ipv4/igmp.c:799
> igmp_timer_expire+0x204/0x510 net/ipv4/igmp.c:-1
> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
> expire_timers kernel/time/timer.c:1798 [inline]
> __run_timers kernel/time/timer.c:2372 [inline]
> __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
> run_timer_base kernel/time/timer.c:2393 [inline]
> run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> __do_softirq kernel/softirq.c:613 [inline]
> invoke_softirq kernel/softirq.c:453 [inline]
> __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
> irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
> instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
> sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
>
> Fixes: 35bec72a24ac ("net: ipv4: Add ip_mr_output()")
> Reported-by: syzbot+f02fb9e43bd85c6c66ae@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/685e841a.a00a0220.129264.0002.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Petr Machata <petrm@nvidia.com>
> Cc: Roopa Prabhu <roopa@nvidia.com>
> Cc: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: Benjamin Poirier <bpoirier@nvidia.com>
> Cc: Ido Schimmel <idosch@nvidia.com>
> ---
> net/ipv4/ipmr.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
> index f78c4e53dc8c161e334781970bbff6069c084ebb..3a2044e6033d5683bda678489f6eaf72ea0b8890 100644
> --- a/net/ipv4/ipmr.c
> +++ b/net/ipv4/ipmr.c
> @@ -2299,7 +2299,8 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> struct mr_table *mrt;
> int vif;
>
> - WARN_ON_ONCE(!rcu_read_lock_held());
> + guard(rcu)();
Interesting construct. :)
> +
> dev = rt->dst.dev;
>
> if (IPCB(skb)->flags & IPSKB_FORWARDED)
> @@ -2313,7 +2314,6 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> if (IS_ERR(mrt))
> goto mc_output;
>
> - /* already under rcu_read_lock() */
> cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
> if (!cache) {
> vif = ipmr_find_vif(mrt, dev);
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu
2025-06-27 11:46 [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu Eric Dumazet
2025-06-27 12:35 ` Neal Cardwell
2025-06-27 13:33 ` Nikolay Aleksandrov
@ 2025-06-27 14:48 ` Petr Machata
2025-06-28 9:50 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Petr Machata @ 2025-06-27 14:48 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
Kuniyuki Iwashima, David Ahern, netdev, eric.dumazet,
syzbot+f02fb9e43bd85c6c66ae, Petr Machata, Roopa Prabhu,
Nikolay Aleksandrov, Benjamin Poirier, Ido Schimmel
Eric Dumazet <edumazet@google.com> writes:
> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
>
> Add guard(rcu)() to fix this in a concise way.
>
> WARNING: CPU: 0 PID: 0 at net/ipv4/ipmr.c:2302 ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302
> Call Trace:
> <IRQ>
> igmp_send_report+0x89e/0xdb0 net/ipv4/igmp.c:799
> igmp_timer_expire+0x204/0x510 net/ipv4/igmp.c:-1
> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
> expire_timers kernel/time/timer.c:1798 [inline]
> __run_timers kernel/time/timer.c:2372 [inline]
> __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
> run_timer_base kernel/time/timer.c:2393 [inline]
> run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> __do_softirq kernel/softirq.c:613 [inline]
> invoke_softirq kernel/softirq.c:453 [inline]
> __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
> irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
> instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
> sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
>
> Fixes: 35bec72a24ac ("net: ipv4: Add ip_mr_output()")
> Reported-by: syzbot+f02fb9e43bd85c6c66ae@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/685e841a.a00a0220.129264.0002.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Petr Machata <petrm@nvidia.com>
> Cc: Roopa Prabhu <roopa@nvidia.com>
> Cc: Nikolay Aleksandrov <razor@blackwall.org>
> Cc: Benjamin Poirier <bpoirier@nvidia.com>
> Cc: Ido Schimmel <idosch@nvidia.com>
Hmm, reading the cleanup.h doco it calls out mixing goto and guards, but
I think it should work in this case, the guard is function scope, and
the gotos are back to this function scope.
Thanks for the fix!
Reviewed-by: Petr Machata <petrm@nvidia.com>
> ---
> net/ipv4/ipmr.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
> index f78c4e53dc8c161e334781970bbff6069c084ebb..3a2044e6033d5683bda678489f6eaf72ea0b8890 100644
> --- a/net/ipv4/ipmr.c
> +++ b/net/ipv4/ipmr.c
> @@ -2299,7 +2299,8 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> struct mr_table *mrt;
> int vif;
>
> - WARN_ON_ONCE(!rcu_read_lock_held());
> + guard(rcu)();
> +
> dev = rt->dst.dev;
>
> if (IPCB(skb)->flags & IPSKB_FORWARDED)
> @@ -2313,7 +2314,6 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
> if (IS_ERR(mrt))
> goto mc_output;
>
> - /* already under rcu_read_lock() */
> cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
> if (!cache) {
> vif = ipmr_find_vif(mrt, dev);
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu
2025-06-27 11:46 [PATCH net-next] net: ipv4: guard ip_mr_output() with rcu Eric Dumazet
` (2 preceding siblings ...)
2025-06-27 14:48 ` Petr Machata
@ 2025-06-28 9:50 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-06-28 9:50 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, kuniyu, dsahern, netdev, eric.dumazet,
syzbot+f02fb9e43bd85c6c66ae, petrm, roopa, razor, bpoirier,
idosch
Hello:
This patch was applied to netdev/net-next.git (main)
by David S. Miller <davem@davemloft.net>:
On Fri, 27 Jun 2025 11:46:41 +0000 you wrote:
> syzbot found at least one path leads to an ip_mr_output()
> without RCU being held.
>
> Add guard(rcu)() to fix this in a concise way.
>
> WARNING: CPU: 0 PID: 0 at net/ipv4/ipmr.c:2302 ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302
> Call Trace:
> <IRQ>
> igmp_send_report+0x89e/0xdb0 net/ipv4/igmp.c:799
> igmp_timer_expire+0x204/0x510 net/ipv4/igmp.c:-1
> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
> expire_timers kernel/time/timer.c:1798 [inline]
> __run_timers kernel/time/timer.c:2372 [inline]
> __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
> run_timer_base kernel/time/timer.c:2393 [inline]
> run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> __do_softirq kernel/softirq.c:613 [inline]
> invoke_softirq kernel/softirq.c:453 [inline]
> __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
> irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
> instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
> sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
>
> [...]
Here is the summary with links:
- [net-next] net: ipv4: guard ip_mr_output() with rcu
https://git.kernel.org/netdev/net-next/c/beead7eea896
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread