Patch "net_sched: gen_estimator: fix lockdep splat" has been added to the 4.15-stable tree

This is a note to let you know that I've just added the patch titled

net_sched: gen_estimator: fix lockdep splat

to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net_sched-gen_estimator-fix-lockdep-splat.patch
and it can be found in the queue-4.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Sat, 27 Jan 2018 10:58:43 -0800
Subject: net_sched: gen_estimator: fix lockdep splat

From: Eric Dumazet <[email protected]>

commit 40ca54e3a686f13117f3de0c443f8026dadf7c44 upstream.

syzbot reported a lockdep splat in gen_new_estimator() / est_fetch_counters() when attempting to lock est->stats_lock.

Since est_fetch_counters() is called from BH context from timer interrupt, we need to block BH as well when calling it from process context.

Most qdiscs use per cpu counters and are immune to the problem, but net/sched/act_api.c and net/netfilter/xt_RATEEST.c are using a spinlock to protect their data. They both call gen_new_estimator() while object is created and not yet alive, so this bug could not trigger a deadlock, only a lockdep splat.

---
 net/core/gen_estimator.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_
 	est->intvl_log = intvl_log;
 	est->cpu_bstats = cpu_bstats;
 
+	if (stats_lock)
+		local_bh_disable();
 	est_fetch_counters(est, &b);
+	if (stats_lock)
+		local_bh_enable();
 	est->last_bytes = b.bytes;
 	est->last_packets = b.packets;
 	old = rcu_dereference_protected(*rate_est, 1);

Patches currently in stable-queue which might be from [email protected] are

queue-4.15/net_sched-gen_estimator-fix-lockdep-splat.patch queue-4.15/tun-fix-tun_napi_alloc_frags-frag-allocator.patch queue-4.15/netfilter-x_tables-avoid-out-of-bounds-reads-in-xt_request_find_-match-target.patch queue-4.15/netfilter-xt_rateest-acquire-xt_rateest_mutex-for-hash-insert.patch