netdev - Re: [PATCH net-next] eth: bnxt: fix deadlock when xdp is attached or detached

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250520151827.GA365796@horms.kernel.org>
Date: Tue, 20 May 2025 16:18:27 +0100
From: Simon Horman <horms@...nel.org>
To: Taehee Yoo <ap420073@...il.com>
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
	edumazet@...gle.com, andrew+netdev@...n.ch, ast@...nel.org,
	daniel@...earbox.net, hawk@...nel.org, john.fastabend@...il.com,
	michael.chan@...adcom.com, pavan.chebbi@...adcom.com,
	sdf@...ichev.me, netdev@...r.kernel.org, bpf@...r.kernel.org,
	jdamato@...tly.com, martin.lau@...nel.org, hramamurthy@...gle.com
Subject: Re: [PATCH net-next] eth: bnxt: fix deadlock when xdp is attached or
 detached

On Tue, May 20, 2025 at 07:11:55AM +0000, Taehee Yoo wrote:
> When xdp is attached or detached, dev->ndo_bpf() is called by
> do_setlink(), and it acquires netdev_lock() if needed.
> Unlike other drivers, the bnxt driver is protected by netdev_lock while
> xdp is attached/detached because it sets dev->request_ops_lock to true.
> 
> So, the bnxt_xdp(), that is callback of ->ndo_bpf should not acquire
> netdev_lock().
> But the xdp_features_{set | clear}_redirect_target() was changed to
> acquire netdev_lock() internally.
> It causes a deadlock.
> To fix this problem, bnxt driver should use
> xdp_features_{set | clear}_redirect_target_locked() instead.
> 
> Splat looks like:
> ============================================
> WARNING: possible recursive locking detected
> 6.15.0-rc6+ #1 Not tainted
> --------------------------------------------
> bpftool/1745 is trying to acquire lock:
> ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: xdp_features_set_redirect_target+0x1f/0x80
> 
> but task is already holding lock:
> ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: do_setlink.constprop.0+0x24e/0x35d0
> 
> other info that might help us debug this:
>  Possible unsafe locking scenario:
> 
>        CPU0
>        ----
>   lock(&dev->lock);
>   lock(&dev->lock);
> 
>  *** DEADLOCK ***

...

> 
> Fixes: 03df156dd3a6 ("xdp: double protect netdev->xdp_flags with netdev->lock")
> Signed-off-by: Taehee Yoo <ap420073@...il.com>
> ---
> 
> This is a bugfix patch but target branch is net-next because the cause
> commit is not yet merged to net.

Reviewed-by: Simon Horman <horms@...nel.org>