netdev - Re: [PATCH net-next] hamradio: use netdev_lockdep_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z8tK0GARvTnW3sdd@mini-arch>
Date: Fri, 7 Mar 2025 11:36:48 -0800
From: Stanislav Fomichev <stfomichev@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Stanislav Fomichev <sdf@...ichev.me>, netdev@...r.kernel.org,
	eric.dumazet@...il.com, syzbot <syzkaller@...glegroups.com>
Subject: Re: [PATCH net-next] hamradio: use netdev_lockdep_set_classes()
 helper

On 03/07, Eric Dumazet wrote:
> It is time to use netdev_lockdep_set_classes() in bpqether.c
> 
> List of related commits:
> 
> 0bef512012b1 ("net: add netdev_lockdep_set_classes() to virtual drivers")
> c74e1039912e ("net: bridge: use netdev_lockdep_set_classes()")
> 9a3c93af5491 ("vlan: use netdev_lockdep_set_classes()")
> 0d7dd798fd89 ("net: ipvlan: call netdev_lockdep_set_classes()")
> 24ffd752007f ("net: macvlan: call netdev_lockdep_set_classes()")
> 78e7a2ae8727 ("net: vrf: call netdev_lockdep_set_classes()")
> d3fff6c443fe ("net: add netdev_lockdep_set_classes() helper")
> 
> syzbot reported:
> 
> WARNING: possible recursive locking detected
> 6.14.0-rc5-syzkaller-01064-g2525e16a2bae #0 Not tainted
> 
> dhcpcd/5501 is trying to acquire lock:
>  ffff8880797e2d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2765 [inline]
>  ffff8880797e2d28 (&dev->lock){+.+.}-{4:4}, at: register_netdevice+0x12d8/0x1b70 net/core/dev.c:11008
> 
> but task is already holding lock:
>  ffff88802e530d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2765 [inline]
>  ffff88802e530d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/linux/netdevice.h:2804 [inline]
>  ffff88802e530d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270 net/core/dev_api.c:65
> 
> other info that might help us debug this:
>  Possible unsafe locking scenario:
> 
>        CPU0
>        ----
>   lock(&dev->lock);
>   lock(&dev->lock);
> 
>  *** DEADLOCK ***
> 
>  May be due to missing lock nesting notation
> 
> 2 locks held by dhcpcd/5501:
>   #0: ffffffff8fed6848 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
>   #0: ffffffff8fed6848 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x34c/0x1d80 net/ipv4/devinet.c:1121
>   #1: ffff88802e530d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2765 [inline]
>   #1: ffff88802e530d28 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops include/linux/netdevice.h:2804 [inline]
>   #1: ffff88802e530d28 (&dev->lock){+.+.}-{4:4}, at: dev_change_flags+0x120/0x270 net/core/dev_api.c:65
> 
> stack backtrace:
> CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.14.0-rc5-syzkaller-01064-g2525e16a2bae #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
> Call Trace:
>  <TASK>
>   __dump_stack lib/dump_stack.c:94 [inline]
>   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
>   print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3039
>   check_deadlock kernel/locking/lockdep.c:3091 [inline]
>   validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3893
>   __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5228
>   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5851
>   __mutex_lock_common kernel/locking/mutex.c:585 [inline]
>   __mutex_lock+0x19c/0x1010 kernel/locking/mutex.c:730
>   netdev_lock include/linux/netdevice.h:2765 [inline]
>   register_netdevice+0x12d8/0x1b70 net/core/dev.c:11008
>   bpq_new_device drivers/net/hamradio/bpqether.c:499 [inline]
>   bpq_device_event+0x4b1/0x8d0 drivers/net/hamradio/bpqether.c:542
>   notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
>  __dev_notify_flags+0x207/0x400
>   netif_change_flags+0xf0/0x1a0 net/core/dev.c:9442
>   dev_change_flags+0x146/0x270 net/core/dev_api.c:66
>   devinet_ioctl+0xea2/0x1d80 net/ipv4/devinet.c:1200
>   inet_ioctl+0x3d7/0x4f0 net/ipv4/af_inet.c:1001
>   sock_do_ioctl+0x158/0x460 net/socket.c:1190
>   sock_ioctl+0x626/0x8e0 net/socket.c:1309
>   vfs_ioctl fs/ioctl.c:51 [inline]
>   __do_sys_ioctl fs/ioctl.c:906 [inline]
>   __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
>   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations")
> Reported-by: syzbot <syzkaller@...glegroups.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Acked-by: Stanislav Fomichev <sdf@...ichev.me>