drivers/net/usb/usbnet.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
usbnet_skb_return() and tx_complete() call this_cpu_ptr() before
disabling IRQs, which triggers a BUG when running with PREEMPT_FULL:
BUG: using smp_processor_id() in preemptible code in tx_complete
Fix by saving IRQs first with local_irq_save(), then calling
this_cpu_ptr() and using the non-irqsave variants of u64_stats
update helpers, since IRQs are already disabled at that point.
Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
Reported-by: syzbot+04cd90bb99c6ef81a65d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=04cd90bb99c6ef81a65d
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
v2: Added Fixes: tag, changed prefix to [PATCH net].
drivers/net/usb/usbnet.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index a19ecf718f36..6a48f38e105d 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -325,7 +325,7 @@ static void __usbnet_status_stop_force(struct usbnet *dev)
*/
void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb)
{
- struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats);
+ struct pcpu_sw_netstats *stats64;
unsigned long flags;
int status;
@@ -338,10 +338,13 @@ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb)
if (skb->protocol == 0)
skb->protocol = eth_type_trans(skb, dev->net);
- flags = u64_stats_update_begin_irqsave(&stats64->syncp);
+ local_irq_save(flags);
+ stats64 = this_cpu_ptr(dev->net->tstats);
+ u64_stats_update_begin(&stats64->syncp);
u64_stats_inc(&stats64->rx_packets);
u64_stats_add(&stats64->rx_bytes, skb->len);
- u64_stats_update_end_irqrestore(&stats64->syncp, flags);
+ u64_stats_update_end(&stats64->syncp);
+ local_irq_restore(flags);
netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n",
skb->len + sizeof(struct ethhdr), skb->protocol);
@@ -1298,13 +1301,16 @@ static void tx_complete(struct urb *urb)
struct usbnet *dev = entry->dev;
if (urb->status == 0) {
- struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats);
+ struct pcpu_sw_netstats *stats64;
unsigned long flags;
- flags = u64_stats_update_begin_irqsave(&stats64->syncp);
+ local_irq_save(flags);
+ stats64 = this_cpu_ptr(dev->net->tstats);
+ u64_stats_update_begin(&stats64->syncp);
u64_stats_add(&stats64->tx_packets, entry->packets);
u64_stats_add(&stats64->tx_bytes, entry->length);
- u64_stats_update_end_irqrestore(&stats64->syncp, flags);
+ u64_stats_update_end(&stats64->syncp);
+ local_irq_restore(flags);
} else {
dev->net->stats.tx_errors++;
--
2.55.0
Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider:
Critical: 0 · High: 0 · Medium: 2 · Low: 0
- [Medium] The commit message's premise is only true for one of the two
changed sites, and the Fixes: tag is provably wrong.
- [Medium] The patch replaces the arch-tuned u64_stats irqsave helpers
with an unconditional local_irq_save()/local_irq_restore() pair around…
--
usbnet: fix smp_processor_id() use in preemptible context
This patch moves the this_cpu_ptr() lookup of dev->net->tstats inside a
local_irq_save()/local_irq_restore() region in usbnet_skb_return() and
tx_complete(), and switches the u64_stats writers from the irqsave
helpers to the plain begin/end variants.
Closes: https://syzkaller.appspot.com/bug?extid=04cd90bb99c6ef81a65d
Two questions on the changelog first:
> usbnet_skb_return() and tx_complete() call this_cpu_ptr() before
> disabling IRQs, which triggers a BUG when running with PREEMPT_FULL:
[Severity: Medium]
Is the "usbnet_skb_return()" half of that sentence reachable? Every
caller I can find already runs with preemption disabled.
rx_process() -> usbnet_skb_return() is only reached from usbnet_bh(),
which is either the dev->delay timer callback:
timer_setup(&dev->delay, usbnet_bh, 0);
or run from usbnet_bh_work() queued on the BH workqueue:
queue_work(system_bh_wq, &dev->bh_work);
and BH work items execute from workqueue_softirq_action(), i.e. softirq
context. The minidriver ->rx_fixup() call sites (asix_common.c,
cdc_ncm.c, rndis_host.c, cx82310_eth.c, lg-vl600.c, ...) are all invoked
from that same rx_process() context.
The one remaining caller explicitly disables BH around the loop:
local_bh_disable();
clear_bit(EVENT_RX_PAUSED, &dev->flags);
while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) {
usbnet_skb_return(dev, skb);
...
That leaves tx_complete(), which really can run in preemptible task
context when the HCD does not use HCD_BH and usb_hcd_giveback_urb()
completes "in the caller's context". Would it make sense to describe the
change as a tx_complete() fix, or is there an RX path that reaches
usbnet_skb_return() with preemption enabled?
> Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
[Severity: Medium]
Does this Fixes: tag point at the right commit? 43daa96b166c is from
2016 and only added usbnet_pause_rx()/usbnet_resume_rx() calls to
usbnet_change_mtu() plus an EVENT_RX_PAUSED test in usbnet_bh(); it never
touched the stats code. git blame on the pre-patch tx_complete() block
shows:
af0c351cc34857 (Heiner Kallweit 2020-11-10) struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats);
2695578b896aea (Eric Dumazet 2018-03-05) flags = u64_stats_update_begin_irqsave(&stats64->syncp);
Should the tag name af0c351cc34857 instead, so that stable backports land
in trees that actually contain the code being changed?
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index a19ecf718f36a..6a48f38e105d4 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -338,10 +338,13 @@ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb)
> if (skb->protocol == 0)
> skb->protocol = eth_type_trans(skb, dev->net);
>
> - flags = u64_stats_update_begin_irqsave(&stats64->syncp);
> + local_irq_save(flags);
> + stats64 = this_cpu_ptr(dev->net->tstats);
> + u64_stats_update_begin(&stats64->syncp);
> u64_stats_inc(&stats64->rx_packets);
> u64_stats_add(&stats64->rx_bytes, skb->len);
> - u64_stats_update_end_irqrestore(&stats64->syncp, flags);
> + u64_stats_update_end(&stats64->syncp);
> + local_irq_restore(flags);
[Severity: Medium]
Does this add a hardirq-off window on 64-bit where there was none? In
include/linux/u64_stats_sync.h the 64-bit branch is:
static inline void __u64_stats_update_begin(struct u64_stats_sync *syncp) { }
static inline void __u64_stats_update_end(struct u64_stats_sync *syncp) { }
static inline unsigned long __u64_stats_irqsave(void) { return 0; }
so u64_stats_update_begin_irqsave() masked nothing on 64-bit, while
local_irq_save() masks unconditionally. usbnet_skb_return() runs once
per received packet, so this looks like a new per-packet interrupts-off
region for all 64-bit builds, PREEMPT_RT included.
The changelog describes it as ordering only:
> Fix by saving IRQs first with local_irq_save(), then calling
> this_cpu_ptr() and using the non-irqsave variants of u64_stats
> update helpers, since IRQs are already disabled at that point.
Since only preemption/migration needs to be suppressed to make
this_cpu_ptr() legal, would get_cpu_ptr()/put_cpu_ptr() around the
existing u64_stats_update_begin_irqsave()/u64_stats_update_end_irqrestore()
pair work here? That keeps IRQ masking on 32-bit only, and matches the
core helper dev_sw_netstats_rx_add() in include/linux/netdevice.h:
struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
u64_stats_update_begin(&tstats->syncp);
usbnet_resume_rx() already uses local_bh_disable() for the same purpose,
which would be another option.
> @@ -1298,13 +1301,16 @@ static void tx_complete(struct urb *urb)
> struct usbnet *dev = entry->dev;
>
> if (urb->status == 0) {
> - struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats);
> + struct pcpu_sw_netstats *stats64;
> unsigned long flags;
>
> - flags = u64_stats_update_begin_irqsave(&stats64->syncp);
> + local_irq_save(flags);
> + stats64 = this_cpu_ptr(dev->net->tstats);
> + u64_stats_update_begin(&stats64->syncp);
> u64_stats_add(&stats64->tx_packets, entry->packets);
> u64_stats_add(&stats64->tx_bytes, entry->length);
> - u64_stats_update_end_irqrestore(&stats64->syncp, flags);
> + u64_stats_update_end(&stats64->syncp);
> + local_irq_restore(flags);
[Severity: Medium]
Same question for the TX completion path: this site is the one that can
genuinely be entered preemptibly, but would get_cpu_ptr()/put_cpu_ptr()
plus the existing irqsave helpers be enough, rather than disabling
interrupts on every successful TX completion on 64-bit?
[ ... ]
--
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260905224553.595766-1-omermetekaya0%40gmail.com
On 06.09.26 00:45, Ömer Mete Kaya wrote: > usbnet_skb_return() and tx_complete() call this_cpu_ptr() before > disabling IRQs, which triggers a BUG when running with PREEMPT_FULL: > > BUG: using smp_processor_id() in preemptible code in tx_complete > > Fix by saving IRQs first with local_irq_save(), then calling > this_cpu_ptr() and using the non-irqsave variants of u64_stats > update helpers, since IRQs are already disabled at that point. Hi, thank you for the patch. However, if the problem is preemption, when not simply preempt_disable()/peempt_enable()? Why is it necessary to switch off interrupts? Regards Oliver
usbnet_skb_return() and tx_complete() call this_cpu_ptr() before
disabling preemption, which triggers a BUG when running with PREEMPT_FULL:
BUG: using smp_processor_id() in preemptible code in tx_complete
Fix by disabling preemption around the this_cpu_ptr() call and the
per-CPU statistics update.
Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change")
Reported-by: syzbot+04cd90bb99c6ef81a65d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=04cd90bb99c6ef81a65d
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
v3: Use preempt_disable()/preempt_enable() instead of
local_irq_save()/restore() as suggested by Oliver Neukum.
drivers/net/usb/usbnet.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index a19ecf718f36..f1e5bc8bf932 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -325,8 +325,7 @@ static void __usbnet_status_stop_force(struct usbnet *dev)
*/
void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb)
{
- struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats);
- unsigned long flags;
+ struct pcpu_sw_netstats *stats64;
int status;
if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
@@ -338,10 +337,13 @@ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb)
if (skb->protocol == 0)
skb->protocol = eth_type_trans(skb, dev->net);
- flags = u64_stats_update_begin_irqsave(&stats64->syncp);
+ preempt_disable();
+ stats64 = this_cpu_ptr(dev->net->tstats);
+ u64_stats_update_begin(&stats64->syncp);
u64_stats_inc(&stats64->rx_packets);
u64_stats_add(&stats64->rx_bytes, skb->len);
- u64_stats_update_end_irqrestore(&stats64->syncp, flags);
+ u64_stats_update_end(&stats64->syncp);
+ preempt_enable();
netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n",
skb->len + sizeof(struct ethhdr), skb->protocol);
@@ -1298,13 +1300,15 @@ static void tx_complete(struct urb *urb)
struct usbnet *dev = entry->dev;
if (urb->status == 0) {
- struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats);
- unsigned long flags;
+ struct pcpu_sw_netstats *stats64;
- flags = u64_stats_update_begin_irqsave(&stats64->syncp);
+ preempt_disable();
+ stats64 = this_cpu_ptr(dev->net->tstats);
+ u64_stats_update_begin(&stats64->syncp);
u64_stats_add(&stats64->tx_packets, entry->packets);
u64_stats_add(&stats64->tx_bytes, entry->length);
- u64_stats_update_end_irqrestore(&stats64->syncp, flags);
+ u64_stats_update_end(&stats64->syncp);
+ preempt_enable();
} else {
dev->net->stats.tx_errors++;
--
2.55.0
© 2016 - 2026 Red Hat, Inc.