[Devel] [PATCH RHEL7 COMMIT] ms/net_sched: gen_estimator: fix lockdep splat

[Vasily Averin]

The commit is pushed to "branch-rh7-3.10.0-1160.6.1.vz7.171.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.6.1.vz7.171.1
------>
commit 77de55310a262695b4f33a8afa791a8c77d34afd
Author: Eric Dumazet <edumazet at google.com>
Date:   Thu Dec 3 11:58:54 2020 +0300

    ms/net_sched: gen_estimator: fix lockdep splat
    
    syzbot reported a lockdep splat in gen_new_estimator() /
    est_fetch_counters() when attempting to lock est->stats_lock.
    
    Since est_fetch_counters() is called from BH context from timer
    interrupt, we need to block BH as well when calling it from process
    context.
    
    Most qdiscs use per cpu counters and are immune to the problem,
    but net/sched/act_api.c and net/netfilter/xt_RATEEST.c are using
    a spinlock to protect their data. They both call gen_new_estimator()
    while object is created and not yet alive, so this bug could
    not trigger a deadlock, only a lockdep splat.
    
    Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
    Signed-off-by: Eric Dumazet <edumazet at google.com>
    Reported-by: syzbot <syzkaller at googlegroups.com>
    Acked-by: Cong Wang <xiyou.wangcong at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>
    
    (cherry-picked from commit 40ca54e3a686f13117f3de0c443f8026dadf7c44)
    https://jira.sw.ru/browse/PSBM-123087
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/core/gen_estimator.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index bca1d06..0e3024c 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 	est->intvl_log = intvl_log;
 	est->cpu_bstats = cpu_bstats;
 
+	if (stats_lock)
+		local_bh_disable();
 	est_fetch_counters(est, &b);
+	if (stats_lock)
+		local_bh_enable();
 	est->last_bytes = b.bytes;
 	est->last_packets = b.packets;
 	old = rcu_dereference_protected(*rate_est, 1);