linux-kernel - Re: [syzbot] [hams?] possible deadlock in nr_rt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250626214902.1880-1-hdanton@sina.com>
Date: Fri, 27 Jun 2025 05:49:01 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+14afda08dc3484d5db82@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [hams?] possible deadlock in nr_rt_ioctl (2)

> Date: Thu, 26 Jun 2025 06:33:30 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    09a0fa92e5b4 Merge tag 'selinux-pr-20250107' of git://git...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=122714b0580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7bdfbaac3fbb90d6
> dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b8db0f980000

#syz test

--- x/net/netrom/nr_route.c
+++ y/net/netrom/nr_route.c
@@ -331,6 +331,7 @@ static int nr_del_node(ax25_address *cal
 		return -EINVAL;
 	}
 
+	spin_lock_bh(&nr_neigh_list_lock);
 	spin_lock_bh(&nr_node_list_lock);
 	nr_node_lock(nr_node);
 	for (i = 0; i < nr_node->count; i++) {
@@ -339,7 +340,7 @@ static int nr_del_node(ax25_address *cal
 			nr_neigh_put(nr_neigh);
 
 			if (nr_neigh->count == 0 && !nr_neigh->locked)
-				nr_remove_neigh(nr_neigh);
+				__nr_remove_neigh(nr_neigh);
 			nr_neigh_put(nr_neigh);
 
 			nr_node->count--;
@@ -361,6 +362,7 @@ static int nr_del_node(ax25_address *cal
 			}
 			nr_node_unlock(nr_node);
 			spin_unlock_bh(&nr_node_list_lock);
+			spin_unlock_bh(&nr_neigh_list_lock);
 
 			return 0;
 		}
@@ -368,6 +370,7 @@ static int nr_del_node(ax25_address *cal
 	nr_neigh_put(nr_neigh);
 	nr_node_unlock(nr_node);
 	spin_unlock_bh(&nr_node_list_lock);
+	spin_unlock_bh(&nr_neigh_list_lock);
 	nr_node_put(nr_node);
 
 	return -EINVAL;
--