For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] BUG: using smp_processor_id() in preemptible code in sk_skb_reason_drop
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 50d05c7c76c96b90462f24debacca971d2e86713

Reported-by: syzbot+dc57fd6722deb17e92af@syzkaller.appspotmail.com

diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index abaf108ac..4c068d613 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -516,6 +516,15 @@ static void net_dm_packet_trace_kfree_skb_hit(void *ignore,
 	 */
 	nskb->tstamp = tstamp;
 
+	/*
+	 * The tracepoint can run in preemptible context (e.g. from
+	 * tcp_data_queue()).  Pin the task to the current CPU before
+	 * dereferencing the per-CPU pointer, otherwise this_cpu_ptr()
+	 * triggers a "using smp_processor_id() in preemptible code"
+	 * splat.  migrate_disable() is used instead of preempt_disable()
+	 * because the drop_queue spinlock can sleep on PREEMPT_RT.
+	 */
+	migrate_disable();
 	data = this_cpu_ptr(&dm_cpu_data);
 
 	spin_lock_irqsave(&data->drop_queue.lock, flags);
@@ -527,6 +536,7 @@ static void net_dm_packet_trace_kfree_skb_hit(void *ignore,
 
 	schedule_work(&data->dm_alert_work);
 
+	migrate_enable();
 	return;
 
 unlock_free:
@@ -534,6 +544,7 @@ static void net_dm_packet_trace_kfree_skb_hit(void *ignore,
 	u64_stats_inc(&data->stats.dropped);
 	u64_stats_update_end(&data->stats.syncp);
 	spin_unlock_irqrestore(&data->drop_queue.lock, flags);
+	migrate_enable();
 	consume_skb(nskb);
 }