linux-kernel - Re: [syzbot] [net?] BUG: sleeping function called from invalid context in synchronize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240713011317.1220-1-hdanton@sina.com>
Date: Sat, 13 Jul 2024 09:13:17 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+9b277e2c2076e2661f61@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] BUG: sleeping function called from invalid context in synchronize_net

On Thu, 11 Jul 2024 14:10:22 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    523b23f0bee3 Add linux-next specific files for 20240710
> git tree:       linux-next
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10ec9585980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  523b23f0bee3

--- x/net/ethtool/ioctl.c
+++ y/net/ethtool/ioctl.c
@@ -58,10 +58,11 @@ static struct devlink *netdev_to_devlink
 
 u32 ethtool_op_get_link(struct net_device *dev)
 {
-	/* Synchronize carrier state with link watch, see also rtnl_getlink() */
-	linkwatch_sync_dev(dev);
+	u32 rc = netif_carrier_ok(dev) ? 1 : 0;
 
-	return netif_carrier_ok(dev) ? 1 : 0;
+	linkwatch_fire_event(NULL);
+
+	return rc;
 }
 EXPORT_SYMBOL(ethtool_op_get_link);
 
--- x/net/core/link_watch.c
+++ y/net/core/link_watch.c
@@ -286,13 +286,17 @@ static void linkwatch_event(struct work_
 
 void linkwatch_fire_event(struct net_device *dev)
 {
-	bool urgent = linkwatch_urgent_event(dev);
+	bool urgent = true;
 
+	if (!dev)
+		goto sched;
+	urgent = linkwatch_urgent_event(dev);
 	if (!test_and_set_bit(__LINK_STATE_LINKWATCH_PENDING, &dev->state)) {
 		linkwatch_add_event(dev);
 	} else if (!urgent)
 		return;
 
+sched:
 	linkwatch_schedule_work(urgent);
 }
 EXPORT_SYMBOL(linkwatch_fire_event);
--