linux-kernel - Re: [syzbot] [net?] WARNING in __linkwatch_sync

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250802230940.3712-1-hdanton@sina.com>
Date: Sun,  3 Aug 2025 07:09:39 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+b8c48ea38ca27d150063@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)

> Date: Fri, 1 Jun 2025 13:30:24 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    27605c8c0f69 Merge tag 'net-6.16-rc2' of git://git.kernel...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17bb9d70580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8e5a54165d499a9
> dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11a7b9d4580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1421310c580000

#syz test upstream master

--- x/drivers/net/bonding/bond_main.c
+++ y/drivers/net/bonding/bond_main.c
@@ -2968,7 +2968,6 @@ static void bond_mii_monitor(struct work
 {
 	struct bonding *bond = container_of(work, struct bonding,
 					    mii_work.work);
-	bool should_notify_peers = false;
 	bool commit;
 	unsigned long delay;
 	struct slave *slave;
@@ -2978,46 +2977,29 @@ static void bond_mii_monitor(struct work
 
 	if (!bond_has_slaves(bond))
 		goto re_arm;
+	/* Race avoidance with bond_close cancel of workqueue */
+	if (!rtnl_trylock()) {
+		delay = 1;
+		goto re_arm;
+	}
 
 	rcu_read_lock();
-	should_notify_peers = bond_should_notify_peers(bond);
 	commit = !!bond_miimon_inspect(bond);
-	if (bond->send_peer_notif) {
-		rcu_read_unlock();
-		if (rtnl_trylock()) {
-			bond->send_peer_notif--;
-			rtnl_unlock();
-		}
-	} else {
-		rcu_read_unlock();
-	}
+	if (bond->send_peer_notif)
+		bond->send_peer_notif--;
+	rcu_read_unlock();
 
 	if (commit) {
-		/* Race avoidance with bond_close cancel of workqueue */
-		if (!rtnl_trylock()) {
-			delay = 1;
-			should_notify_peers = false;
-			goto re_arm;
-		}
-
 		bond_for_each_slave(bond, slave, iter) {
 			bond_commit_link_state(slave, BOND_SLAVE_NOTIFY_LATER);
 		}
 		bond_miimon_commit(bond);
-
-		rtnl_unlock();	/* might sleep, hold no other locks */
 	}
+	rtnl_unlock();
 
 re_arm:
 	if (bond->params.miimon)
 		queue_delayed_work(bond->wq, &bond->mii_work, delay);
-
-	if (should_notify_peers) {
-		if (!rtnl_trylock())
-			return;
-		call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
-		rtnl_unlock();
-	}
 }
 
 static int bond_upper_dev_walk(struct net_device *upper,
--