tx_complete() calls this_cpu_ptr() before disabling preemption, which triggers a BUG when running with CONFIG_DEBUG_PREEMPT: BUG: using smp_processor_id() in preemptible code in tx_complete Fix by using get_cpu_ptr()/put_cpu_ptr() which disable preemption and return the per-CPU pointer atomically. The usbnet_skb_return() hunk is a hardening change: that path runs in softirq context so no warning fires there, but the same fix is applied for consistency. Fixes: ed194d136769 ("usb: core: remove local_irq_save() around ->complete() handler") Suggested-by: David Laight Reported-by: syzbot+04cd90bb99c6ef81a65d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=04cd90bb99c6ef81a65d Signed-off-by: Ömer Mete Kaya --- v6: Fix commit message and Fixes tag as pointed out by Sashiko: - BUG is in tx_complete(), not usbnet_skb_return() - usbnet_skb_return() hunk is hardening, not a fix - CONFIG_DEBUG_PREEMPT, not PREEMPT_FULL - Fixes tag updated to ed194d136769 --- drivers/net/usb/usbnet.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index a19ecf718f36..84f97f448b2d 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -325,7 +325,7 @@ static void __usbnet_status_stop_force(struct usbnet *dev) */ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb) { - struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats); + struct pcpu_sw_netstats *stats64; unsigned long flags; int status; @@ -338,10 +338,12 @@ void usbnet_skb_return(struct usbnet *dev, struct sk_buff *skb) if (skb->protocol == 0) skb->protocol = eth_type_trans(skb, dev->net); + stats64 = get_cpu_ptr(dev->net->tstats); flags = u64_stats_update_begin_irqsave(&stats64->syncp); u64_stats_inc(&stats64->rx_packets); u64_stats_add(&stats64->rx_bytes, skb->len); u64_stats_update_end_irqrestore(&stats64->syncp, flags); + put_cpu_ptr(dev->net->tstats); netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n", skb->len + sizeof(struct ethhdr), skb->protocol); @@ -1298,13 +1300,15 @@ static void tx_complete(struct urb *urb) struct usbnet *dev = entry->dev; if (urb->status == 0) { - struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->net->tstats); + struct pcpu_sw_netstats *stats64; unsigned long flags; + stats64 = get_cpu_ptr(dev->net->tstats); flags = u64_stats_update_begin_irqsave(&stats64->syncp); u64_stats_add(&stats64->tx_packets, entry->packets); u64_stats_add(&stats64->tx_bytes, entry->length); u64_stats_update_end_irqrestore(&stats64->syncp, flags); + put_cpu_ptr(dev->net->tstats); } else { dev->net->stats.tx_errors++; -- 2.55.0