Forwarded: [PATCH] BUG: using smp_processor_id() in preemptible code in sk_skb_reason_drop

[syzbot <syzbot+dc57fd6722deb17e92af@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] BUG: using smp_processor_id() in preemptible code in sk_skb_reason_drop
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Reported-by: syzbot+dc57fd6722deb17e92af@syzkaller.appspotmail.com

diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index abaf108ac..80b56a47c 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -516,7 +516,14 @@ static void net_dm_packet_trace_kfree_skb_hit(void *ignore,
 	 */
 	nskb->tstamp = tstamp;
 
-	data = this_cpu_ptr(&dm_cpu_data);
+	/*
+	 * This function may be called from preemptible context (e.g. when
+	 * kfree_skb() is called from process context), so use raw_cpu_ptr()
+	 * to avoid the debug_smp_processor_id() warning emitted by
+	 * this_cpu_ptr(). CPU migration after the pointer is fetched is
+	 * harmless because the per-CPU data is serialized by the lock below.
+	 */
+	data = raw_cpu_ptr(&dm_cpu_data);
 
 	spin_lock_irqsave(&data->drop_queue.lock, flags);
 	if (skb_queue_len(&data->drop_queue) < net_dm_queue_len)