linux-kernel - Re: drivers/vhost/net.c:1010 vhost_net_rx_peek_head_len() error: double unlocked 'sk->sk_receive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5b711270-1307-9c57-548c-59404984ce66@redhat.com>
Date:   Tue, 11 Aug 2020 11:03:12 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     "Michael S. Tsirkin" <mst@...hat.com>,
        kernel test robot <lkp@...el.com>
Cc:     kbuild-all@...ts.01.org, linux-kernel@...r.kernel.org
Subject: Re: drivers/vhost/net.c:1010 vhost_net_rx_peek_head_len() error:
 double unlocked 'sk->sk_receive_queue.lock' (orig line 1002)


On 2020/8/10 下午8:33, Michael S. Tsirkin wrote:
> On Sat, Aug 08, 2020 at 03:37:07PM +0800, kernel test robot wrote:
>> Hi Jason,
>>
>> First bad commit (maybe != root cause):
>>
>> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>> head:   449dc8c97089a6e09fb2dac4d92b1b7ac0eb7c1e
>> commit: 20c384f1ea1a0bc7320bc445c72dd02d2970d594 vhost: refine vhost and vringh kconfig
>> date:   4 months ago
>> config: arm-randconfig-m031-20200808 (attached as .config)
>> compiler: arm-linux-gnueabi-gcc (GCC) 9.3.0
>>
>> If you fix the issue, kindly add following tag as appropriate
>> Reported-by: kernel test robot <lkp@...el.com>
>>
>> New smatch warnings:
>> drivers/vhost/net.c:1010 vhost_net_rx_peek_head_len() error: double unlocked 'sk->sk_receive_queue.lock' (orig line 1002)
>> drivers/vhost/net.c:1010 vhost_net_rx_peek_head_len() error: double unlocked 'sk->sk_receive_queue.lock' (orig line 1002)
> Weird. Can't figure out where the double unlock is ...


Yes, looks like a false positive.

Thanks


>
>
>> Old smatch warnings:
>> drivers/vhost/net.c:1528 vhost_net_set_backend() warn: passing a valid pointer to 'PTR_ERR'
> this stumped me too...
>
>> vim +1010 drivers/vhost/net.c
>>
>> 8dd014adfea6f17 David Stevens   2010-07-27   994
>> be294a51adfc1e1 Toshiaki Makita 2018-07-03   995  static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk,
>> be294a51adfc1e1 Toshiaki Makita 2018-07-03   996  				      bool *busyloop_intr)
>> 030881372460654 Jason Wang      2016-03-04   997  {
>> 28b9b33b983f4de Toshiaki Makita 2018-07-03   998  	struct vhost_net_virtqueue *rnvq = &net->vqs[VHOST_NET_VQ_RX];
>> 28b9b33b983f4de Toshiaki Makita 2018-07-03   999  	struct vhost_net_virtqueue *tnvq = &net->vqs[VHOST_NET_VQ_TX];
>> 6369fec5be0aad4 Toshiaki Makita 2018-07-03  1000  	struct vhost_virtqueue *rvq = &rnvq->vq;
>> 28b9b33b983f4de Toshiaki Makita 2018-07-03  1001  	struct vhost_virtqueue *tvq = &tnvq->vq;
>> 28b9b33b983f4de Toshiaki Makita 2018-07-03 @1002  	int len = peek_head_len(rnvq, sk);
>> 030881372460654 Jason Wang      2016-03-04  1003
>> dc151282bbdaed0 Tonghao Zhang   2018-09-25  1004  	if (!len && rvq->busyloop_timeout) {
>> f5a4941aa6d190e Jason Wang      2018-05-29  1005  		/* Flush batched heads first */
>> 09c3248938c3e3b Jason Wang      2018-07-20  1006  		vhost_net_signal_used(rnvq);
>> 030881372460654 Jason Wang      2016-03-04  1007  		/* Both tx vq and rx socket were polled here */
>> dc151282bbdaed0 Tonghao Zhang   2018-09-25  1008  		vhost_net_busy_poll(net, rvq, tvq, busyloop_intr, true);
>> 030881372460654 Jason Wang      2016-03-04  1009
>> 28b9b33b983f4de Toshiaki Makita 2018-07-03 @1010  		len = peek_head_len(rnvq, sk);
>> 030881372460654 Jason Wang      2016-03-04  1011  	}
>> 030881372460654 Jason Wang      2016-03-04  1012
>> 030881372460654 Jason Wang      2016-03-04  1013  	return len;
>> 030881372460654 Jason Wang      2016-03-04  1014  }
>> 030881372460654 Jason Wang      2016-03-04  1015
>>
>> :::::: The code at line 1010 was first introduced by commit
>> :::::: 28b9b33b983f4de3ce9e660e3efe1e08adabf779 vhost_net: Rename local variables in vhost_net_rx_peek_head_len
>>
>> :::::: TO: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
>> :::::: CC: David S. Miller <davem@...emloft.net>
>>
>> ---
>> 0-DAY CI Kernel Test Service, Intel Corporation
>> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
>