Patch "r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     r8169-fix-the-kcsan-reported-data-race-in-rtl_rx-whi.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6f1d0ab6a768263f7c6b2662555784ece948b6ac
Author: Mirsad Goran Todorovac <mirsad.todorovac@xxxxxxxxxxxx>
Date:   Wed Oct 18 21:34:38 2023 +0200

    r8169: fix the KCSAN reported data race in rtl_rx while reading desc->opts1
    
    [ Upstream commit f97eee484e71890131f9c563c5cc6d5a69e4308d ]
    
    KCSAN reported the following data-race bug:
    
    ==================================================================
    BUG: KCSAN: data-race in rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4430 drivers/net/ethernet/realtek/r8169_main.c:4583) r8169
    
    race at unknown origin, with read to 0xffff888117e43510 of 4 bytes by interrupt on cpu 21:
    rtl8169_poll (drivers/net/ethernet/realtek/r8169_main.c:4430 drivers/net/ethernet/realtek/r8169_main.c:4583) r8169
    __napi_poll (net/core/dev.c:6527)
    net_rx_action (net/core/dev.c:6596 net/core/dev.c:6727)
    __do_softirq (kernel/softirq.c:553)
    __irq_exit_rcu (kernel/softirq.c:427 kernel/softirq.c:632)
    irq_exit_rcu (kernel/softirq.c:647)
    sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1074 (discriminator 14))
    asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:645)
    cpuidle_enter_state (drivers/cpuidle/cpuidle.c:291)
    cpuidle_enter (drivers/cpuidle/cpuidle.c:390)
    call_cpuidle (kernel/sched/idle.c:135)
    do_idle (kernel/sched/idle.c:219 kernel/sched/idle.c:282)
    cpu_startup_entry (kernel/sched/idle.c:378 (discriminator 1))
    start_secondary (arch/x86/kernel/smpboot.c:210 arch/x86/kernel/smpboot.c:294)
    secondary_startup_64_no_verify (arch/x86/kernel/head_64.S:433)
    
    value changed: 0x80003fff -> 0x3402805f
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 21 PID: 0 Comm: swapper/21 Tainted: G             L     6.6.0-rc2-kcsan-00143-gb5cbe7c00aa0 #41
    Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023
    ==================================================================
    
    drivers/net/ethernet/realtek/r8169_main.c:
    ==========================================
       4429
     → 4430                 status = le32_to_cpu(desc->opts1);
       4431                 if (status & DescOwn)
       4432                         break;
       4433
       4434                 /* This barrier is needed to keep us from reading
       4435                  * any other fields out of the Rx descriptor until
       4436                  * we know the status of DescOwn
       4437                  */
       4438                 dma_rmb();
       4439
       4440                 if (unlikely(status & RxRES)) {
       4441                         if (net_ratelimit())
       4442                                 netdev_warn(dev, "Rx ERROR. status = %08x\n",
    
    Marco Elver explained that dma_rmb() doesn't prevent the compiler to tear up the access to
    desc->opts1 which can be written to concurrently. READ_ONCE() should prevent that from
    happening:
    
       4429
     → 4430                 status = le32_to_cpu(READ_ONCE(desc->opts1));
       4431                 if (status & DescOwn)
       4432                         break;
       4433
    
    As the consequence of this fix, this KCSAN warning was eliminated.
    
    Fixes: 6202806e7c03a ("r8169: drop member opts1_mask from struct rtl8169_private")
    Suggested-by: Marco Elver <elver@xxxxxxxxxx>
    Cc: Heiner Kallweit <hkallweit1@xxxxxxxxx>
    Cc: nic_swsd@xxxxxxxxxxx
    Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
    Cc: Eric Dumazet <edumazet@xxxxxxxxxx>
    Cc: Jakub Kicinski <kuba@xxxxxxxxxx>
    Cc: Paolo Abeni <pabeni@xxxxxxxxxx>
    Cc: netdev@xxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/lkml/dc7fc8fa-4ea4-e9a9-30a6-7c83e6b53188@xxxxxxxxxxxx/
    Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@xxxxxxxxxxxx>
    Acked-by: Marco Elver <elver@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index d5a52fcd57cd0..1cd0928472c0c 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -4513,7 +4513,7 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, int budget
 		dma_addr_t addr;
 		u32 status;
 
-		status = le32_to_cpu(desc->opts1);
+		status = le32_to_cpu(READ_ONCE(desc->opts1));
 		if (status & DescOwn)
 			break;
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux