Re: suspicious RCU usage at ./include/linux/inetdevice.h:LINE

[Cong Wang]

On Thu, Nov 2, 2017 at 3:53 AM, syzbot
<bot+e52a2ae091b628f72765583c9faedc961c83b7e7@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
> Hello,
>
> syzkaller hit the following crash on
> ce43f4fd6f103681c7485c2b1967179647e73555
> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
>
>
>
>
>
> =============================
> WARNING: suspicious RCU usage
> 4.14.0-rc5+ #140 Not tainted
> -----------------------------
> ./include/linux/inetdevice.h:230 suspicious rcu_dereference_protected()
> usage!
>
> other info that might help us debug this:
>
>
> rcu_scheduler_active = 2, debug_locks = 1
> 1 lock held by syz-executor2/23859:
>  #0:  (rcu_read_lock){....}, at: [<ffffffff840283f0>]
> inet_rtm_getroute+0xaa0/0x2d70 net/ipv4/route.c:2738
>
> stack backtrace:
> CPU: 0 PID: 23859 Comm: syz-executor2 Not tainted 4.14.0-rc5+ #140
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:16 [inline]
>  dump_stack+0x194/0x257 lib/dump_stack.c:52
>  lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4665
>  __in_dev_get_rtnl include/linux/inetdevice.h:230 [inline]
>  fib_dump_info+0x1136/0x13d0 net/ipv4/fib_semantics.c:1377
>  inet_rtm_getroute+0xf97/0x2d70 net/ipv4/route.c:2785

This is introduced by:

commit 394f51abb3d04f33fb798f04b16ae6b0491ea4ec
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Tue Aug 15 16:34:44 2017 +0200

    ipv4: route: set ipv4 RTM_GETROUTE to not use rtnl

    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>

Looks like we need a wrapper for rcu_dereference_protected(dev->ip_ptr).