CVE-2023-52578

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: bridge: use DEV_STATS_INC()<br /> <br /> syzbot/KCSAN reported data-races in br_handle_frame_finish() [1]<br /> This function can run from multiple cpus without mutual exclusion.<br /> <br /> Adopt SMP safe DEV_STATS_INC() to update dev-&gt;stats fields.<br /> <br /> Handles updates to dev-&gt;stats.tx_dropped while we are at it.<br /> <br /> [1]<br /> BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish<br /> <br /> read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:<br /> br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189<br /> br_nf_hook_thresh+0x1ed/0x220<br /> br_nf_pre_routing_finish_ipv6+0x50f/0x540<br /> NF_HOOK include/linux/netfilter.h:304 [inline]<br /> br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178<br /> br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508<br /> nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]<br /> nf_hook_bridge_pre net/bridge/br_input.c:272 [inline]<br /> br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417<br /> __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417<br /> __netif_receive_skb_one_core net/core/dev.c:5521 [inline]<br /> __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637<br /> process_backlog+0x21f/0x380 net/core/dev.c:5965<br /> __napi_poll+0x60/0x3b0 net/core/dev.c:6527<br /> napi_poll net/core/dev.c:6594 [inline]<br /> net_rx_action+0x32b/0x750 net/core/dev.c:6727<br /> __do_softirq+0xc1/0x265 kernel/softirq.c:553<br /> run_ksoftirqd+0x17/0x20 kernel/softirq.c:921<br /> smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164<br /> kthread+0x1d7/0x210 kernel/kthread.c:388<br /> ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147<br /> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304<br /> <br /> read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:<br /> br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189<br /> br_nf_hook_thresh+0x1ed/0x220<br /> br_nf_pre_routing_finish_ipv6+0x50f/0x540<br /> NF_HOOK include/linux/netfilter.h:304 [inline]<br /> br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178<br /> br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508<br /> nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]<br /> nf_hook_bridge_pre net/bridge/br_input.c:272 [inline]<br /> br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417<br /> __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417<br /> __netif_receive_skb_one_core net/core/dev.c:5521 [inline]<br /> __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637<br /> process_backlog+0x21f/0x380 net/core/dev.c:5965<br /> __napi_poll+0x60/0x3b0 net/core/dev.c:6527<br /> napi_poll net/core/dev.c:6594 [inline]<br /> net_rx_action+0x32b/0x750 net/core/dev.c:6727<br /> __do_softirq+0xc1/0x265 kernel/softirq.c:553<br /> do_softirq+0x5e/0x90 kernel/softirq.c:454<br /> __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381<br /> __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]<br /> _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210<br /> spin_unlock_bh include/linux/spinlock.h:396 [inline]<br /> batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356<br /> batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560<br /> process_one_work kernel/workqueue.c:2630 [inline]<br /> process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703<br /> worker_thread+0x525/0x730 kernel/workqueue.c:2784<br /> kthread+0x1d7/0x210 kernel/kthread.c:388<br /> ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147<br /> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304<br /> <br /> value changed: 0x00000000000d7190 -&gt; 0x00000000000d7191<br /> <br /> Reported by Kernel Concurrency Sanitizer on:<br /> CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0