Re: [syzbot] [PATCH] net/sched: taprio: fix CPU stuck due to the taprio hrtimer

From: syzbot
Date: Fri May 03 2024 - 05:22:54 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [PATCH] net/sched: taprio: fix CPU stuck due to the taprio hrtimer
Author: luyun@xxxxxxxxxx

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

---
net/sched/sch_taprio.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index a0d54b422186..360778f65d9e 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -104,6 +104,7 @@ struct taprio_sched {
u32 max_sdu[TC_MAX_QUEUE]; /* save info from the user */
u32 fp[TC_QOPT_MAX_QUEUE]; /* only for dump and offloading */
u32 txtime_delay;
+ ktime_t offset;
};

struct __tc_taprio_qopt_offload {
@@ -170,6 +171,13 @@ static ktime_t sched_base_time(const struct sched_gate_list *sched)
return ns_to_ktime(sched->base_time);
}

+static ktime_t taprio_get_offset(enum tk_offsets tk_offset)
+{
+ ktime_t time = ktime_get();
+
+ return ktime_sub_ns(ktime_mono_to_any(time, tk_offset), time);
+}
+
static ktime_t taprio_mono_to_any(const struct taprio_sched *q, ktime_t mono)
{
/* This pairs with WRITE_ONCE() in taprio_parse_clockid() */
@@ -918,6 +926,8 @@ static enum hrtimer_restart advance_sched(struct hrtimer *timer)
int num_tc = netdev_get_num_tc(dev);
struct sched_entry *entry, *next;
struct Qdisc *sch = q->root;
+ enum tk_offsets tk_offset = READ_ONCE(q->tk_offset);
+ ktime_t now_offset = taprio_get_offset(tk_offset);
ktime_t end_time;
int tc;

@@ -957,6 +967,14 @@ static enum hrtimer_restart advance_sched(struct hrtimer *timer)
end_time = ktime_add_ns(entry->end_time, next->interval);
end_time = min_t(ktime_t, end_time, oper->cycle_end_time);

+ if (q->offset != now_offset) {
+ ktime_t diff = ktime_sub_ns(now_offset, q->offset);
+
+ end_time = ktime_add_ns(end_time, diff);
+ oper->cycle_end_time = ktime_add_ns(oper->cycle_end_time, diff);
+ q->offset = now_offset;
+ }
+
for (tc = 0; tc < num_tc; tc++) {
if (next->gate_duration[tc] == oper->cycle_time)
next->gate_close_time[tc] = KTIME_MAX;
@@ -1205,11 +1223,13 @@ static int taprio_get_start_time(struct Qdisc *sch,
ktime_t *start)
{
struct taprio_sched *q = qdisc_priv(sch);
+ enum tk_offsets tk_offset = READ_ONCE(q->tk_offset);
ktime_t now, base, cycle;
s64 n;

base = sched_base_time(sched);
now = taprio_get_time(q);
+ q->offset = taprio_get_offset(tk_offset);

if (ktime_after(base, now)) {
*start = base;
--
2.34.1