Eric Dumazet
7af6164cee
bonding: fix data-races around agg_select_timer
commit 9ceaf6f76b203682bb6100e14b3d7da4c0bedde8 upstream.
syzbot reported that two threads might write over agg_select_timer
at the same time. Make agg_select_timer atomic to fix the races.
BUG: KCSAN: data-race in bond_3ad_initiate_agg_selection / bond_3ad_state_machine_handler
read to 0xffff8881242aea90 of 4 bytes by task 1846 on cpu 1:
bond_3ad_state_machine_handler+0x99/0x2810 drivers/net/bonding/bond_3ad.c:2317
process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
worker_thread+0x616/0xa70 kernel/workqueue.c:2454
kthread+0x1bf/0x1e0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30
write to 0xffff8881242aea90 of 4 bytes by task 25910 on cpu 0:
bond_3ad_initiate_agg_selection+0x18/0x30 drivers/net/bonding/bond_3ad.c:1998
bond_open+0x658/0x6f0 drivers/net/bonding/bond_main.c:3967
__dev_open+0x274/0x3a0 net/core/dev.c:1407
dev_open+0x54/0x190 net/core/dev.c:1443
bond_enslave+0xcef/0x3000 drivers/net/bonding/bond_main.c:1937
do_set_master net/core/rtnetlink.c:2532 [inline]
do_setlink+0x94f/0x2500 net/core/rtnetlink.c:2736
__rtnl_newlink net/core/rtnetlink.c:3414 [inline]
rtnl_newlink+0xfeb/0x13e0 net/core/rtnetlink.c:3529
rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg net/socket.c:725 [inline]
____sys_sendmsg+0x39a/0x510 net/socket.c:2413
___sys_sendmsg net/socket.c:2467 [inline]
__sys_sendmsg+0x195/0x230 net/socket.c:2496
__do_sys_sendmsg net/socket.c:2505 [inline]
__se_sys_sendmsg net/socket.c:2503 [inline]
__x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000050 -> 0x0000004f
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25910 Comm: syz-executor.1 Tainted: G W 5.17.0-rc4-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2022-02-23 11:59:58 +01:00 |
| .. |
|
accessibility
|
|
|
|
acpi
|
ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE
|
2022-02-16 12:52:54 +01:00 |
|
amba
|
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
|
2021-11-06 13:59:45 +01:00 |
|
android
|
binder: fix handling of error during copy
|
2022-01-27 09:19:38 +01:00 |
|
ata
|
libata: if T_LENGTH is zero, dma direction should be DMA_NONE
|
2021-12-22 09:29:39 +01:00 |
|
atm
|
|
|
|
auxdisplay
|
auxdisplay: ht16k33: Fix frame buffer device blanking
|
2021-11-17 09:48:45 +01:00 |
|
base
|
PM: s2idle: ACPI: Fix wakeup interrupts handling
|
2022-02-16 12:52:50 +01:00 |
|
bcma
|
bcma: Fix memory leak for internally-handled cores
|
2021-09-15 09:47:37 +02:00 |
|
block
|
floppy: Add max size check for user space request
|
2022-01-27 09:19:42 +01:00 |
|
bluetooth
|
Bluetooth: hci_bcm: Check for error irq
|
2022-01-27 09:19:36 +01:00 |
|
bus
|
bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893
|
2021-10-13 10:08:19 +02:00 |
|
cdrom
|
|
|
|
char
|
random: do not throw away excess input to crng_fast_load
|
2022-01-27 09:19:46 +01:00 |
|
clk
|
clk: si5341: Fix clock HW provider cleanup
|
2022-01-27 09:19:53 +01:00 |
|
clocksource
|
clocksource/drivers/timer-ti-dm: Select TIMER_OF
|
2021-11-17 09:48:39 +01:00 |
|
connector
|
|
|
|
counter
|
counter: 104-quad-8: Return error when invalid mode during ceiling_write
|
2021-09-15 09:47:34 +02:00 |
|
cpufreq
|
cpufreq: Fix initialization of min and max frequency QoS requests
|
2022-01-27 09:19:44 +01:00 |
|
cpuidle
|
cpuidle: Fix kobject memory leaks in error paths
|
2021-11-17 09:48:36 +01:00 |
|
crypto
|
crypto: caam - replace this_cpu_ptr with raw_cpu_ptr
|
2022-01-27 09:19:49 +01:00 |
|
dax
|
|
|
|
dca
|
|
|
|
devfreq
|
|
|
|
dio
|
|
|
|
dma
|
dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending
|
2022-02-23 11:59:57 +01:00 |
|
dma-buf
|
dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()
|
2022-01-27 09:19:28 +01:00 |
|
edac
|
EDAC/xgene: Fix deferred probing
|
2022-02-08 18:24:34 +01:00 |
|
eisa
|
|
|
|
extcon
|
|
|
|
firewire
|
|
|
|
firmware
|
firmware: Update Kconfig help text for Google firmware
|
2022-01-27 09:19:51 +01:00 |
|
fpga
|
fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()
|
2021-09-30 10:09:23 +02:00 |
|
fsi
|
|
|
|
gnss
|
|
|
|
gpio
|
gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
|
2022-01-27 09:19:43 +01:00 |
|
gpu
|
drm/radeon: Fix backlight control on iMac 12,1
|
2022-02-23 11:59:56 +01:00 |
|
greybus
|
|
|
|
hid
|
HID:Add support for UGTABLET WP5540
|
2022-02-23 11:59:54 +01:00 |
|
hsi
|
HSI: core: Fix return freed object in hsi_new_client
|
2022-01-27 09:19:41 +01:00 |
|
hv
|
hyperv/vmbus: include linux/bitops.h
|
2021-11-17 09:48:20 +01:00 |
|
hwmon
|
hwmon: (dell-smm) Speed up setting of fan speed
|
2022-02-16 12:52:53 +01:00 |
|
hwspinlock
|
|
|
|
hwtracing
|
|
|
|
i2c
|
i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
|
2022-01-27 09:19:48 +01:00 |
|
i3c
|
|
|
|
ide
|
|
|
|
idle
|
|
|
|
iio
|
iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda
|
2021-12-22 09:29:35 +01:00 |
|
infiniband
|
RDMA/mlx4: Don't continue event handler after memory allocation failure
|
2022-02-08 18:24:29 +01:00 |
|
input
|
Input: touchscreen - Fix backport of a02dcde595f7cbd240ccd64de96034ad91cffc40
|
2022-01-11 15:23:30 +01:00 |
|
interconnect
|
|
|
|
iommu
|
iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
|
2022-02-08 18:24:30 +01:00 |
|
ipack
|
ipack: ipoctal: fix module reference leak
|
2021-10-06 15:42:36 +02:00 |
|
irqchip
|
irqchip: nvic: Fix offset for Interrupt Priority Offsets
|
2021-12-14 14:49:06 +01:00 |
|
isdn
|
mISDN: change function names to avoid conflicts
|
2022-01-11 15:23:33 +01:00 |
|
leds
|
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
|
2021-09-15 09:47:33 +02:00 |
|
lightnvm
|
|
|
|
macintosh
|
|
|
|
mailbox
|
|
|
|
mcb
|
mcb: fix error handling in mcb_alloc_bus()
|
2021-09-30 10:09:22 +02:00 |
|
md
|
dm space map common: add bounds check to sm_ll_lookup_bitmap()
|
2022-01-27 09:19:46 +01:00 |
|
media
|
media: rcar-csi2: Optimize the selection PHTW register
|
2022-01-27 09:19:51 +01:00 |
|
memory
|
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
|
2021-11-17 09:48:42 +01:00 |
|
memstick
|
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
|
2021-11-17 09:48:37 +01:00 |
|
message
|
|
|
|
mfd
|
mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
|
2022-01-16 09:15:38 +01:00 |
|
misc
|
eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
|
2022-02-16 12:52:52 +01:00 |
|
mmc
|
mmc: block: fix read single on recovery logic
|
2022-02-23 11:59:57 +01:00 |
|
mtd
|
mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()
|
2022-02-01 17:24:40 +01:00 |
|
mux
|
|
|
|
net
|
bonding: fix data-races around agg_select_timer
|
2022-02-23 11:59:58 +01:00 |
|
nfc
|
NFC: st21nfca: Fix memory leak in device probe and remove
|
2022-01-05 12:37:44 +01:00 |
|
ntb
|
NTB: perf: Fix an error code in perf_setup_inbuf()
|
2021-09-22 12:26:44 +02:00 |
|
nubus
|
|
|
|
nvdimm
|
libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind
|
2021-10-06 15:42:38 +02:00 |
|
nvme
|
nvme-rdma: fix possible use-after-free in transport error_recovery work
|
2022-02-23 11:59:56 +01:00 |
|
nvmem
|
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
|
2021-10-20 11:40:14 +02:00 |
|
of
|
of: base: Improve argument length mismatch error
|
2022-01-27 09:19:51 +01:00 |
|
opp
|
opp: Fix return in _opp_add_static_v2()
|
2021-11-17 09:48:44 +01:00 |
|
oprofile
|
|
|
|
parisc
|
parisc: Fix sglist access in ccio-dma.c
|
2022-02-23 11:59:54 +01:00 |
|
parport
|
parport: remove non-zero check on count
|
2021-09-22 12:26:36 +02:00 |
|
pci
|
PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
|
2022-02-05 12:35:36 +01:00 |
|
pcmcia
|
pcmcia: fix setting of kthread task states
|
2022-01-27 09:19:37 +01:00 |
|
perf
|
|
|
|
phy
|
phy: uniphier-usb3ss: fix unintended writing zeros to PHY register
|
2022-01-27 09:19:39 +01:00 |
|
pinctrl
|
pinctrl: bcm2835: Fix a few error paths
|
2022-02-08 18:24:33 +01:00 |
|
platform
|
platform/x86: ISST: Fix possible circular locking dependency detected
|
2022-02-23 11:59:55 +01:00 |
|
pnp
|
|
|
|
power
|
power: bq25890: Enable continuous conversion for ADC at charging
|
2022-01-27 09:19:49 +01:00 |
|
powercap
|
|
|
|
pps
|
|
|
|
ps3
|
|
|
|
ptp
|
ptp_pch: Load module automatically if ID matches
|
2021-10-13 10:08:19 +02:00 |
|
pwm
|
pwm: stm32-lp: Don't modify HW state in .remove() callback
|
2021-09-26 14:07:13 +02:00 |
|
rapidio
|
|
|
|
ras
|
|
|
|
regulator
|
regulator: qcom_smd: Align probe function with rpmh-regulator
|
2022-01-27 09:19:46 +01:00 |
|
remoteproc
|
|
|
|
reset
|
reset: socfpga: add empty driver allowing consumers to probe
|
2021-11-17 09:48:20 +01:00 |
|
rpmsg
|
rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
|
2022-02-01 17:24:36 +01:00 |
|
rtc
|
rtc: cmos: Evaluate century appropriate
|
2022-02-08 18:24:34 +01:00 |
|
s390
|
scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
|
2022-02-01 17:24:33 +01:00 |
|
sbus
|
|
|
|
scsi
|
scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled
|
2022-02-16 12:52:53 +01:00 |
|
sfi
|
|
|
|
sh
|
maple: fix wrong return value of maple_bus_init().
|
2021-11-26 10:47:17 +01:00 |
|
siox
|
|
|
|
slimbus
|
slimbus: ngd: reset dma setup during runtime pm
|
2021-08-26 08:36:21 -04:00 |
|
soc
|
Revert "ASoC: mediatek: Check for error clk pointer"
|
2022-02-08 18:24:28 +01:00 |
|
soundwire
|
|
|
|
spi
|
spi: meson-spicc: add IRQ check in meson_spicc_probe
|
2022-02-08 18:24:30 +01:00 |
|
spmi
|
|
|
|
ssb
|
|
|
|
staging
|
staging: fbtft: Fix error path in fbtft_driver_module_init()
|
2022-02-16 12:52:50 +01:00 |
|
target
|
scsi: target: iscsi: Make sure the np under each tpg is unique
|
2022-02-16 12:52:48 +01:00 |
|
tc
|
|
|
|
tee
|
tee: fix put order in teedev_close_context()
|
2022-01-27 09:19:30 +01:00 |
|
thermal
|
thermal: core: Reset previous low and high trip during thermal zone init
|
2021-12-08 09:01:09 +01:00 |
|
thunderbolt
|
|
|
|
tty
|
serial: parisc: GSC: fix build when IOSAPIC is not set
|
2022-02-23 11:59:54 +01:00 |
|
uio
|
|
|
|
usb
|
USB: serial: cp210x: add CPI Bulk Coin Recycler id
|
2022-02-16 12:52:53 +01:00 |
|
vfio
|
vfio: Use config not menuconfig for VFIO_NOIOMMU
|
2021-09-22 12:26:23 +02:00 |
|
vhost
|
vhost/vsock: fix incorrect used length reported to the guest
|
2021-12-01 09:23:34 +01:00 |
|
video
|
vgacon: Propagate console boot parameters before calling `vc_resize'
|
2021-12-08 09:01:13 +01:00 |
|
virt
|
|
|
|
virtio
|
virtio_ring: Fix querying of maximum DMA mapping size for virtio device
|
2021-12-22 09:29:34 +01:00 |
|
visorbus
|
|
|
|
vlynq
|
|
|
|
vme
|
|
|
|
w1
|
w1: Misuse of get_user()/put_user() reported by sparse
|
2022-01-27 09:19:48 +01:00 |
|
watchdog
|
ar7: fix kernel builds for compiler test
|
2021-11-17 09:48:46 +01:00 |
|
xen
|
xen: detect uninitialized xenbus in xenbus_init
|
2021-12-01 09:23:28 +01:00 |
|
zorro
|
|
|
|
Kconfig
|
|
|
|
Makefile
|
|
|