Message-ID: <6872f8f5.a70a0220.3b380f.000f.GAE@google.com>
Date: Sat, 12 Jul 2025 17:08:21 -0700
From: syzbot <syzbot+8182574047912f805d59@...kaller.appspotmail.com>
To: kapoorarnav43@...il.com
Cc: kapoorarnav43@...il.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: Private message regarding: [syzbot] [net?] BUG: sleeping function
 called from invalid context in team_change_rx_flags (2)

> #syz test
>
> From: Arnav Kapoor <kapoorarnnav43@...il.com>
> Date: Sat, 13 Jul 2025 00:00:00 +0000
> Subject: [PATCH] team: Fix sleeping function called from invalid context in 
> team_change_rx_flags
>
> The syzbot report shows a "sleeping function called from invalid context" 
> warning in team_change_rx_flags(). The issue occurs because this function
> is called while holding netif_addr_lock_bh (atomic context), but it calls
> dev_set_promiscuity() and dev_set_allmulti() which can sleep due to 
> mutex_lock(&dev->lock) in the netdev_lock_ops() path.
>
> The call chain is:
> dev_uc_add() 
> └── netif_addr_lock_bh() [atomic context]
>     └── __dev_set_rx_mode()
>         └── team_change_rx_flags()
>             └── dev_set_promiscuity()
>                 └── netdev_lock_ops()
>                     └── mutex_lock(&dev->lock) [sleeping function]
>
> The functions dev_set_promiscuity() and dev_set_allmulti() are designed
> to be called from process context, not atomic context. Since 
> team_change_rx_flags() is called from atomic context, we need to defer
> the actual promiscuity/allmulti changes to process context using a 
> work queue.
>
> This patch adds a work queue to handle the deferred RX flags changes,
> ensuring that the mutex-acquiring functions are called from process
> context where sleeping is allowed.
>
> Reported-by: syzbot+8182574047912f805d59@...kaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=8182574047912f805d59
> Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
> Cc: stable@...r.kernel.org
> Signed-off-by: Arnav Kapoor <kapoorarnnav43@...il.com>
> ---
>  drivers/net/team/team_core.c | 65 ++++++++++++++++++++++++++++++------
>  include/linux/if_team.h      |  5 +++
>  2 files changed, 60 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
> index abcd1234..efgh5678 100644
> --- a/drivers/net/team/team_core.c
> +++ b/drivers/net/team/team_core.c
> @@ -1772,19 +1772,51 @@ static u16 team_select_queue(struct net_device 
> *dev, struct sk_buff *skb,
>   return txq;
>  }
>  
> +static void team_change_rx_flags_work(struct work_struct *work)
> +{
> + struct team *team = container_of(work, struct team, rx_flags_work);
> + struct team_port *port;
> + int change, inc;
> + unsigned int flags;
> +
> + mutex_lock(&team->lock);
> + change = team->rx_flags_change;
> + flags = team->rx_flags_dev_flags;
> + team->rx_flags_change = 0;
> + 
> + list_for_each_entry(port, &team->port_list, list) {
> + if (change & IFF_PROMISC) {
> + inc = flags & IFF_PROMISC ? 1 : -1;
> + dev_set_promiscuity(port->dev, inc);
> + }
> + if (change & IFF_ALLMULTI) {
> + inc = flags & IFF_ALLMULTI ? 1 : -1;
> + dev_set_allmulti(port->dev, inc);
> + }
> + }
> + mutex_unlock(&team->lock);
> +}
> +
>  static void team_change_rx_flags(struct net_device *dev, int change)
>  {
>   struct team *team = netdev_priv(dev);
> - struct team_port *port;
> - int inc;
> -
> - rcu_read_lock();
> - list_for_each_entry_rcu(port, &team->port_list, list) {
> - if (change & IFF_PROMISC) {
> - inc = dev->flags & IFF_PROMISC ? 1 : -1;
> - dev_set_promiscuity(port->dev, inc);
> - }
> - if (change & IFF_ALLMULTI) {
> - inc = dev->flags & IFF_ALLMULTI ? 1 : -1;
> - dev_set_allmulti(port->dev, inc);
> - }
> - }
> - rcu_read_unlock();
> + 
> + /*
> +  * Cannot call dev_set_promiscuity/dev_set_allmulti from atomic context
> +  * as they acquire netdev mutex via netdev_lock_ops(). This function is
> +  * called with netif_addr_lock_bh held (atomic context), so we must defer
> +  * the actual flag changes to process context using a work queue.
> +  */
> + spin_lock(&team->rx_flags_lock);
> + team->rx_flags_change |= change;
> + team->rx_flags_dev_flags = dev->flags;
> + spin_unlock(&team->rx_flags_lock);
> + 
> + schedule_work(&team->rx_flags_work);
>  }
>  
>  static void team_set_rx_mode(struct net_device *dev)
> @@ -1629,6 +1661,9 @@ static int team_init(struct net_device *dev)
>   mutex_init(&team->lock);
>   lockdep_register_key(&team->team_lock_key);
>   __mutex_set_name(&team->lock, "team->lock", &team->team_lock_key);
> + 
> + spin_lock_init(&team->rx_flags_lock);
> + INIT_WORK(&team->rx_flags_work, team_change_rx_flags_work);
>  
>   return 0;
>  
> @@ -1651,6 +1686,16 @@ static void team_uninit(struct net_device *dev)
>   struct team *team = netdev_priv(dev);
>   struct team_port *port;
>   struct team_port *tmp;
> + 
> + /*
> +  * Make sure any pending rx_flags work is completed before
> +  * destroying the team device
> +  */
> + cancel_work_sync(&team->rx_flags_work);
> + 
> + /* Clear any pending flags to avoid work being rescheduled */
> + spin_lock_bh(&team->rx_flags_lock);
> + team->rx_flags_change = 0;
> + spin_unlock_bh(&team->rx_flags_lock);
>  
>   mutex_lock(&team->lock);
>   list_for_each_entry_safe(port, tmp, &team->port_list, list)
> diff --git a/include/linux/if_team.h b/include/linux/if_team.h
> index abcd1234..efgh5678 100644
> --- a/include/linux/if_team.h
> +++ b/include/linux/if_team.h
> @@ -189,6 +189,11 @@ struct team {
>   struct net_device *dev; /* associated netdevice */
>   struct team_pcpu_stats __percpu *pcpu_stats;
>  
> + /* RX flags handling - deferred to work queue to avoid atomic context 
> issues */
> + struct work_struct rx_flags_work;
> + spinlock_t rx_flags_lock;
> + int rx_flags_change;
> + unsigned int rx_flags_dev_flags;
>   struct team_port __rcu *port_list[TEAM_PORT_HASHENTRIES];
>  
>   struct list_head port_list;
> -- 
> 2.34.1
>
>
> On Friday, 11 July 2025 at 20:46:35 UTC+5:30 syzbot wrote:
>
> Hello, 
>
> syzbot found the following issue on: 
>
> HEAD commit: dd831ac8221e net/sched: sch_qfq: Fix null-deref in agg_deq.. 
> git tree: net 
> console output: https://syzkaller.appspot.com/x/log.txt?x=13245bd4580000 
> kernel config: https://syzkaller.appspot.com/x/.config?x=b29b1a0d7330d4a8 
> dashboard link: https://syzkaller.appspot.com/bug?extid=8182574047912f805d59 
> compiler: Debian clang version 20.1.7 
> (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 
> 20.1.7 
>
> Unfortunately, I don't have any reproducer for this issue yet. 
>
> Downloadable assets: 
> disk image: 
> https://storage.googleapis.com/syzbot-assets/b7b63815bf2a/disk-dd831ac8.raw.xz 
> vmlinux: 
> https://storage.googleapis.com/syzbot-assets/f857222aabbb/vmlinux-dd831ac8.xz 
> kernel image: 
> https://storage.googleapis.com/syzbot-assets/9071ec6016d0/bzImage-dd831ac8.xz 
>
> IMPORTANT: if you fix the issue, please add the following tag to the 
> commit: 
> Reported-by: syzbot+818257...@...kaller.appspotmail.com 
>
> netlink: 8 bytes leftover after parsing attributes in process `syz.1.1814'. 
> macsec0: entered promiscuous mode 
> team0: entered promiscuous mode 
> BUG: sleeping function called from invalid context at 
> kernel/locking/mutex.c:579 
> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 12326, name: 
> syz.1.1814 
> preempt_count: 201, expected: 0 
> RCU nest depth: 0, expected: 0 
> 3 locks held by syz.1.1814/12326: 
> #0: ffffffff8fa21eb8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire 
> include/linux/rcupdate.h:331 [inline] 
> #0: ffffffff8fa21eb8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock 
> include/linux/rcupdate.h:841 [inline] 
> #0: ffffffff8fa21eb8 (&ops->srcu#2){.+.+}-{0:0}, at: 
> rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 
> #1: ffffffff8f51c5c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock 
> net/core/rtnetlink.c:80 [inline] 
> #1: ffffffff8f51c5c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock 
> net/core/rtnetlink.c:341 [inline] 
> #1: ffffffff8f51c5c8 (rtnl_mutex){+.+.}-{4:4}, at: 
> rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4054 
> #2: ffff8880635e8368 (&macsec_netdev_addr_lock_key#2/2){+...}-{3:3}, at: 
> netif_addr_lock_bh include/linux/netdevice.h:4805 [inline] 
> #2: ffff8880635e8368 (&macsec_netdev_addr_lock_key#2/2){+...}-{3:3}, at: 
> dev_uc_add+0x67/0x120 net/core/dev_addr_lists.c:689 
> Preemption disabled at: 
> [<ffffffff895a7d26>] local_bh_disable include/linux/bottom_half.h:20 
> [inline] 
> [<ffffffff895a7d26>] netif_addr_lock_bh include/linux/netdevice.h:4804 
> [inline] 
> [<ffffffff895a7d26>] dev_uc_add+0x56/0x120 net/core/dev_addr_lists.c:689 
> CPU: 0 UID: 0 PID: 12326 Comm: syz.1.1814 Not tainted 
> 6.16.0-rc4-syzkaller-00153-gdd831ac8221e #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS 
> Google 05/07/2025 
> Call Trace: 
> <TASK> 
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 
> __might_resched+0x495/0x610 kernel/sched/core.c:8800 
> __mutex_lock_common kernel/locking/mutex.c:579 [inline] 
> __mutex_lock+0x106/0xe80 kernel/locking/mutex.c:747 
> team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781 
> dev_change_rx_flags net/core/dev.c:9241 [inline] 
> __dev_set_promiscuity+0x534/0x740 net/core/dev.c:9285 
> netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9305 
> dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:287 
> dev_change_rx_flags net/core/dev.c:9241 [inline] 
> __dev_set_promiscuity+0x534/0x740 net/core/dev.c:9285 
> __dev_set_rx_mode+0x17c/0x260 net/core/dev.c:-1 
> dev_uc_add+0xc8/0x120 net/core/dev_addr_lists.c:693 
> macsec_dev_open+0xd9/0x530 drivers/net/macsec.c:3634 
> __dev_open+0x470/0x880 net/core/dev.c:1683 
> __dev_change_flags+0x1ea/0x6d0 net/core/dev.c:9458 
> rtnl_configure_link net/core/rtnetlink.c:3577 [inline] 
> rtnl_newlink_create+0x555/0xb00 net/core/rtnetlink.c:3833 
> __rtnl_newlink net/core/rtnetlink.c:3940 [inline] 
> rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055 
> rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6944 
> netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2551 
> netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] 
> netlink_unicast+0x75c/0x8e0 net/netlink/af_netlink.c:1346 
> netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 
> sock_sendmsg_nosec net/socket.c:712 [inline] 
> __sock_sendmsg+0x219/0x270 net/socket.c:727 
> ____sys_sendmsg+0x505/0x830 net/socket.c:2566 
> ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 
> __sys_sendmsg net/socket.c:2652 [inline] 
> __do_sys_sendmsg net/socket.c:2657 [inline] 
> __se_sys_sendmsg net/socket.c:2655 [inline] 
> __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2655 
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] 
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 
> entry_SYSCALL_64_after_hwframe+0x77/0x7f 
> RIP: 0033:0x7f2785b8e929 
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff 
> ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 
> RSP: 002b:00007f27869d6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 
> RAX: ffffffffffffffda RBX: 00007f2785db5fa0 RCX: 00007f2785b8e929 
> RDX: 0000000000000800 RSI: 0000200000000280 RDI: 0000000000000009 
> RBP: 00007f2785c10b39 R08: 0000000000000000 R09: 0000000000000000 
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 
> R13: 0000000000000000 R14: 00007f2785db5fa0 R15: 00007ffe1c84aa28 
> </TASK> 
>
> ============================= 
> [ BUG: Invalid wait context ] 
> 6.16.0-rc4-syzkaller-00153-gdd831ac8221e #0 Tainted: G W 
> ----------------------------- 
> syz.1.1814/12326 is trying to lock: 
> ffff88802715ce00 (team->team_lock_key#2){+.+.}-{4:4}, at: 
> team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781 
> other info that might help us debug this: 
> context-{5:5} 
> 3 locks held by syz.1.1814/12326: 
> #0: ffffffff8fa21eb8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire 
> include/linux/rcupdate.h:331 [inline] 
> #0: ffffffff8fa21eb8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock 
> include/linux/rcupdate.h:841 [inline] 
> #0: ffffffff8fa21eb8 (&ops->srcu#2){.+.+}-{0:0}, at: 
> rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 
> #1: ffffffff8f51c5c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock 
> net/core/rtnetlink.c:80 [inline] 
> #1: ffffffff8f51c5c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock 
> net/core/rtnetlink.c:341 [inline] 
> #1: ffffffff8f51c5c8 (rtnl_mutex){+.+.}-{4:4}, at: 
> rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4054 
> #2: ffff8880635e8368 (&macsec_netdev_addr_lock_key#2/2){+...}-{3:3}, at: 
> netif_addr_lock_bh include/linux/netdevice.h:4805 [inline] 
> #2: ffff8880635e8368 (&macsec_netdev_addr_lock_key#2/2){+...}-{3:3}, at: 
> dev_uc_add+0x67/0x120 net/core/dev_addr_lists.c:689 
> stack backtrace: 
> CPU: 0 UID: 0 PID: 12326 Comm: syz.1.1814 Tainted: G W 
> 6.16.0-rc4-syzkaller-00153-gdd831ac8221e #0 PREEMPT(full) 
> Tainted: [W]=WARN 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS 
> Google 05/07/2025 
> Call Trace: 
> <TASK> 
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 
> print_lock_invalid_wait_context kernel/locking/lockdep.c:4833 [inline] 
> check_wait_context kernel/locking/lockdep.c:4905 [inline] 
> __lock_acquire+0xbcb/0xd20 kernel/locking/lockdep.c:5190 
> lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5871 
> __mutex_lock_common kernel/locking/mutex.c:602 [inline] 
> __mutex_lock+0x182/0xe80 kernel/locking/mutex.c:747 
> team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781 
> dev_change_rx_flags net/core/dev.c:9241 [inline] 
> __dev_set_promiscuity+0x534/0x740 net/core/dev.c:9285 
> netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9305 
> dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:287 
> dev_change_rx_flags net/core/dev.c:9241 [inline] 
> __dev_set_promiscuity+0x534/0x740 net/core/dev.c:9285 
> __dev_set_rx_mode+0x17c/0x260 net/core/dev.c:-1 
> dev_uc_add+0xc8/0x120 net/core/dev_addr_lists.c:693 
> macsec_dev_open+0xd9/0x530 drivers/net/macsec.c:3634 
> __dev_open+0x470/0x880 net/core/dev.c:1683 
> __dev_change_flags+0x1ea/0x6d0 net/core/dev.c:9458 
> rtnl_configure_link net/core/rtnetlink.c:3577 [inline] 
> rtnl_newlink_create+0x555/0xb00 net/core/rtnetlink.c:3833 
> __rtnl_newlink net/core/rtnetlink.c:3940 [inline] 
> rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055 
> rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6944 
> netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2551 
> netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] 
> netlink_unicast+0x75c/0x8e0 net/netlink/af_netlink.c:1346 
> netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 
> sock_sendmsg_nosec net/socket.c:712 [inline] 
> __sock_sendmsg+0x219/0x270 net/socket.c:727 
> ____sys_sendmsg+0x505/0x830 net/socket.c:2566 
> ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620 
> __sys_sendmsg net/socket.c:2652 [inline] 
> __do_sys_sendmsg net/socket.c:2657 [inline] 
> __se_sys_sendmsg net/socket.c:2655 [inline] 
> __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2655 
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] 
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 
> entry_SYSCALL_64_after_hwframe+0x77/0x7f 
> RIP: 0033:0x7f2785b8e929 
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff 
> ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 
> RSP: 002b:00007f27869d6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 
> RAX: ffffffffffffffda RBX: 00007f2785db5fa0 RCX: 00007f2785b8e929 
> RDX: 0000000000000800 RSI: 0000200000000280 RDI: 0000000000000009 
> RBP: 00007f2785c10b39 R08: 0000000000000000 R09: 0000000000000000 
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 
> R13: 0000000000000000 R14: 00007f2785db5fa0 R15: 00007ffe1c84aa28 
> </TASK> 
>
>
> --- 
> This report is generated by a bot. It may contain errors. 
> See https://goo.gl/tpsmEJ for more information about syzbot. 
> syzbot engineers can be reached at syzk...@...glegroups.com. 
>
> syzbot will keep track of this issue. See: 
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot. 
>
> If the report is already addressed, let syzbot know by replying with: 
> #syz fix: exact-commit-title 
>
> If you want to overwrite report's subsystems, reply with: 
> #syz set subsystems: new-subsystem 
> (See the list of subsystem names on the web dashboard) 
>
> If the report is a duplicate of another one, reply with: 
> #syz dup: exact-subject-of-another-report 
>
> If you want to undo deduplication, reply with: 
> #syz undup 
>

Command #1:
This crash does not have a reproducer. I cannot test it.

Powered by blists - more mailing lists