linux-kernel - Re: [PATCH net v2] af_packet: move notifier's packet_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <682f59a9887be_12c79229452@willemb.c.googlers.com.notmuch>
Date: Thu, 22 May 2025 13:06:49 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Stanislav Fomichev <stfomichev@...il.com>, 
 netdev@...r.kernel.org
Cc: davem@...emloft.net, 
 edumazet@...gle.com, 
 kuba@...nel.org, 
 pabeni@...hat.com, 
 willemdebruijn.kernel@...il.com, 
 horms@...nel.org, 
 stfomichev@...il.com, 
 linux-kernel@...r.kernel.org, 
 syzbot+b191b5ccad8d7a986286@...kaller.appspotmail.com
Subject: Re: [PATCH net v2] af_packet: move notifier's packet_dev_mc out of
 rcu critical section

Stanislav Fomichev wrote:
> Syzkaller reports the following issue:
> 
>  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578
>  __mutex_lock+0x106/0xe80 kernel/locking/mutex.c:746
>  team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781
>  dev_change_rx_flags net/core/dev.c:9145 [inline]
>  __dev_set_promiscuity+0x3f8/0x590 net/core/dev.c:9189
>  netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9201
>  dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:286 packet_dev_mc net/packet/af_packet.c:3698 [inline]
>  packet_dev_mclist_delete net/packet/af_packet.c:3722 [inline]
>  packet_notifier+0x292/0xa60 net/packet/af_packet.c:4247
>  notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
>  call_netdevice_notifiers_extack net/core/dev.c:2214 [inline]
>  call_netdevice_notifiers net/core/dev.c:2228 [inline]
>  unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:11972
>  rtnl_delete_link net/core/rtnetlink.c:3522 [inline]
>  rtnl_dellink+0x488/0x710 net/core/rtnetlink.c:3564
>  rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6955
>  netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534
> 
> Calling `PACKET_ADD_MEMBERSHIP` on an ops-locked device can trigger
> the `NETDEV_UNREGISTER` notifier, which may require disabling promiscuous
> and/or allmulti mode. Both of these operations require acquiring
> the netdev instance lock.
> 
> Move the call to `packet_dev_mc` outside of the RCU critical section.
> The `mclist` modifications (add, del, flush, unregister) are protected by
> the RTNL, not the RCU. The RCU only protects the `sklist` and its
> associated `sks`. The delayed operation on the `mclist` entry remains
> within the RTNL.
> 
> Reported-by: syzbot+b191b5ccad8d7a986286@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=b191b5ccad8d7a986286
> Fixes: ad7c7b2172c3 ("net: hold netdev instance lock during sysfs operations")
> Signed-off-by: Stanislav Fomichev <stfomichev@...il.com>

Reviewed-by: Willem de Bruijn <willemb@...gle.com>