linux-kernel - Re: [syzbot] [net?] possible deadlock in inet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c035df1c-abaf-9173-032f-3dd91b296101@huaweicloud.com>
Date: Mon, 8 Sep 2025 16:52:44 +0800
From: Yu Kuai <yukuai1@...weicloud.com>
To: Eric Dumazet <edumazet@...gle.com>,
 syzbot <syzbot+e1cd6bd8493060bd701d@...kaller.appspotmail.com>,
 Josef Bacik <josef@...icpanda.com>, Jens Axboe <axboe@...nel.dk>
Cc: davem@...emloft.net, dsahern@...nel.org, horms@...nel.org,
 kuba@...nel.org, linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
 ming.lei@...hat.com, netdev@...r.kernel.org, pabeni@...hat.com,
 syzkaller-bugs@...glegroups.com, thomas.hellstrom@...ux.intel.com,
 "yukuai (C)" <yukuai3@...wei.com>
Subject: Re: [syzbot] [net?] possible deadlock in inet_shutdown

Hi,

在 2025/09/06 17:16, Eric Dumazet 写道:
> On Fri, Sep 5, 2025 at 1:03 PM Eric Dumazet <edumazet@...gle.com> wrote:
>>
>> On Fri, Sep 5, 2025 at 1:00 PM syzbot
>> <syzbot+e1cd6bd8493060bd701d@...kaller.appspotmail.com> wrote:
> 
> Note to NBD maintainers : I held about  20 syzbot reports all pointing
> to NBD accepting various sockets, I  can release them if needed, if you prefer
> to triage them.
> 
I'm not NBD maintainer, just trying to understand the deadlock first.

Is this deadlock only possible for some sepecific socket types? Take
a look at the report here:

Usually issue IO will require the order:

q_usage_counter -> cmd lock -> tx lock -> sk lock

Hence the condition is that if the sock_sendmsg() will hold sk lock to
allocate new memory, and can trigger fs reclaim, and finally issue new
IO to this nbd?

Thanks,
Kuai

>>
>> Question to NBD maintainers.
>>
>> What socket types are supposed to be supported by NBD ?
>>
>> I was thinking adding a list of supported ones, assuming TCP and
>> stream unix are the only ones:
>>
>> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
>> index 6463d0e8d0ce..87b0b78249da 100644
>> --- a/drivers/block/nbd.c
>> +++ b/drivers/block/nbd.c
>> @@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct
>> nbd_device *nbd, unsigned long fd,
>>          if (!sock)
>>                  return NULL;
>>
>> +       if (!sk_is_tcp(sock->sk) &&
>> +           !sk_is_stream_unix(sock->sk)) {
>> +               dev_err(disk_to_dev(nbd->disk), "Unsupported socket:
>> should be TCP or UNIX.\n");
>> +               *err = -EINVAL;
>> +               sockfd_put(sock);
>> +               return NULL;
>> +       }
>> +
>>          if (sock->ops->shutdown == sock_no_shutdown) {
>>                  dev_err(disk_to_dev(nbd->disk), "Unsupported socket:
>> shutdown callout must be supported.\n");
>>                  *err = -EINVAL;
> 
> .
>