genetlink: hold RCU in genlmsg_mcast()

While running net selftests with CONFIG_PROVE_RCU_LIST=y I saw
one lockdep splat [1].

genlmsg_mcast() uses for_each_net_rcu(), and must therefore hold RCU.

Instead of letting all callers guard genlmsg_multicast_allns()
with a rcu_read_lock()/rcu_read_unlock() pair, do it in genlmsg_mcast().

This also means the @flags parameter is useless, we need to always use
GFP_ATOMIC.

[1]
[10882.424136] =============================
[10882.424166] WARNING: suspicious RCU usage
[10882.424309] 6.12.0-rc2-virtme #1156 Not tainted
[10882.424400] -----------------------------
[10882.424423] net/netlink/genetlink.c:1940 RCU-list traversed in non-reader section!!
[10882.424469]
other info that might help us debug this:

[10882.424500]
rcu_scheduler_active = 2, debug_locks = 1
[10882.424744] 2 locks held by ip/15677:
[10882.424791] #0: ffffffffb6b491b0 (cb_lock){++++}-{3:3}, at: genl_rcv (net/netlink/genetlink.c:1219)
[10882.426334] #1: ffffffffb6b49248 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg (net/netlink/genetlink.c:61 net/netlink/genetlink.c:57 net/netlink/genetlink.c:1209)
[10882.426465]
stack backtrace:
[10882.426805] CPU: 14 UID: 0 PID: 15677 Comm: ip Not tainted 6.12.0-rc2-virtme #1156
[10882.426919] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[10882.427046] Call Trace:
[10882.427131]  <TASK>
[10882.427244] dump_stack_lvl (lib/dump_stack.c:123)
[10882.427335] lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822)
[10882.427387] genlmsg_multicast_allns (net/netlink/genetlink.c:1940 (discriminator 7) net/netlink/genetlink.c:1977 (discriminator 7))
[10882.427436] l2tp_tunnel_notify.constprop.0 (net/l2tp/l2tp_netlink.c:119) l2tp_netlink
[10882.427683] l2tp_nl_cmd_tunnel_create (net/l2tp/l2tp_netlink.c:253) l2tp_netlink
[10882.427748] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1115)
[10882.427834] genl_rcv_msg (net/netlink/genetlink.c:1195 net/netlink/genetlink.c:1210)
[10882.427877] ? __pfx_l2tp_nl_cmd_tunnel_create (net/l2tp/l2tp_netlink.c:186) l2tp_netlink
[10882.427927] ? __pfx_genl_rcv_msg (net/netlink/genetlink.c:1201)
[10882.427959] netlink_rcv_skb (net/netlink/af_netlink.c:2551)
[10882.428069] genl_rcv (net/netlink/genetlink.c:1220)
[10882.428095] netlink_unicast (net/netlink/af_netlink.c:1332 net/netlink/af_netlink.c:1357)
[10882.428140] netlink_sendmsg (net/netlink/af_netlink.c:1901)
[10882.428210] ____sys_sendmsg (net/socket.c:729 (discriminator 1) net/socket.c:744 (discriminator 1) net/socket.c:2607 (discriminator 1))

Fixes: 33f72e6f0c67 ("l2tp : multicast notification to the registered listeners")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: James Chapman <jchapman@katalix.com>
Cc: Tom Parkin <tparkin@katalix.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20241011171217.3166614-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 7eb94894bd68faf639a9fc02da004b986df89c2b..717931267bda0c52829c628d09cbfbf80ea63a54 100644 (file)
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -2130,7 +2130,7 @@ static int tcmu_netlink_event_send(struct tcmu_dev *udev,
        }
 
        ret = genlmsg_multicast_allns(&tcmu_genl_family, skb, 0,
-                                     TCMU_MCGRP_CONFIG, GFP_KERNEL);
+                                     TCMU_MCGRP_CONFIG);
 
        /* Wait during an add as the listener may not be up yet */
        if (ret == 0 ||

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 9ab49bfeae789afc11338ac1c89bb081566554a8..c1d91f1d20f6c9badde002fc0f412a3ce73a89c5 100644 (file)
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -531,13 +531,12 @@ static inline int genlmsg_multicast(const struct genl_family *family,
  * @skb: netlink message as socket buffer
  * @portid: own netlink portid to avoid sending to yourself
  * @group: offset of multicast group in groups array
- * @flags: allocation flags
  *
  * This function must hold the RTNL or rcu_read_lock().
  */
 int genlmsg_multicast_allns(const struct genl_family *family,
                            struct sk_buff *skb, u32 portid,
-                           unsigned int group, gfp_t flags);
+                           unsigned int group);
 
 /**
  * genlmsg_unicast - unicast a netlink message

diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 284f1dec1b56dd07b4e6e22af3088233b4a25069..59457c0c14aab811b6157819ca4c9ac1eb579b6f 100644 (file)
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -116,7 +116,7 @@ static int l2tp_tunnel_notify(struct genl_family *family,
                                  NLM_F_ACK, tunnel, cmd);
 
        if (ret >= 0) {
-               ret = genlmsg_multicast_allns(family, msg, 0, 0, GFP_ATOMIC);
+               ret = genlmsg_multicast_allns(family, msg, 0, 0);
                /* We don't care if no one is listening */
                if (ret == -ESRCH)
                        ret = 0;
@@ -144,7 +144,7 @@ static int l2tp_session_notify(struct genl_family *family,
                                   NLM_F_ACK, session, cmd);
 
        if (ret >= 0) {
-               ret = genlmsg_multicast_allns(family, msg, 0, 0, GFP_ATOMIC);
+               ret = genlmsg_multicast_allns(family, msg, 0, 0);
                /* We don't care if no one is listening */
                if (ret == -ESRCH)
                        ret = 0;

diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index feb54c63a1165f25bdeb95daa11080374ad91761..07ad65774fe298a1fea8e67413521252fc31ed20 100644 (file)
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1501,15 +1501,11 @@ static int genl_ctrl_event(int event, const struct genl_family *family,
        if (IS_ERR(msg))
                return PTR_ERR(msg);
 
-       if (!family->netnsok) {
+       if (!family->netnsok)
                genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
                                        0, GFP_KERNEL);
-       } else {
-               rcu_read_lock();
-               genlmsg_multicast_allns(&genl_ctrl, msg, 0,
-                                       0, GFP_ATOMIC);
-               rcu_read_unlock();
-       }
+       else
+               genlmsg_multicast_allns(&genl_ctrl, msg, 0, 0);
 
        return 0;
 }
@@ -1929,23 +1925,23 @@ problem:
 
 core_initcall(genl_init);
 
-static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
-                        gfp_t flags)
+static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group)
 {
        struct sk_buff *tmp;
        struct net *net, *prev = NULL;
        bool delivered = false;
        int err;
 
+       rcu_read_lock();
        for_each_net_rcu(net) {
                if (prev) {
-                       tmp = skb_clone(skb, flags);
+                       tmp = skb_clone(skb, GFP_ATOMIC);
                        if (!tmp) {
                                err = -ENOMEM;
                                goto error;
                        }
                        err = nlmsg_multicast(prev->genl_sock, tmp,
-                                             portid, group, flags);
+                                             portid, group, GFP_ATOMIC);
                        if (!err)
                                delivered = true;
                        else if (err != -ESRCH)
@@ -1954,27 +1950,31 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
 
                prev = net;
        }
+       err = nlmsg_multicast(prev->genl_sock, skb, portid, group, GFP_ATOMIC);
+
+       rcu_read_unlock();
 
-       err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
        if (!err)
                delivered = true;
        else if (err != -ESRCH)
                return err;
        return delivered ? 0 : -ESRCH;
  error:
+       rcu_read_unlock();
+
        kfree_skb(skb);
        return err;
 }
 
 int genlmsg_multicast_allns(const struct genl_family *family,
                            struct sk_buff *skb, u32 portid,
-                           unsigned int group, gfp_t flags)
+                           unsigned int group)
 {
        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                return -EINVAL;
 
        group = family->mcgrp_offset + group;
-       return genlmsg_mcast(skb, portid, group, flags);
+       return genlmsg_mcast(skb, portid, group);
 }
 EXPORT_SYMBOL(genlmsg_multicast_allns);
 

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 9ab777e0bd4d3493619ed73b279a80a84ce476e2..d7d099f7118ab5d5c745905abdea85d246c2b7b2 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -17986,10 +17986,8 @@ void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
 
        genlmsg_end(msg, hdr);
 
-       rcu_read_lock();
        genlmsg_multicast_allns(&nl80211_fam, msg, 0,
-                               NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
-       rcu_read_unlock();
+                               NL80211_MCGRP_REGULATORY);
 
        return;
 
@@ -18722,10 +18720,8 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
 
        genlmsg_end(msg, hdr);
 
-       rcu_read_lock();
        genlmsg_multicast_allns(&nl80211_fam, msg, 0,
-                               NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
-       rcu_read_unlock();
+                               NL80211_MCGRP_REGULATORY);
 
        return;