netdev - Re: [PATCH net] net: gro_cells: fix lock imbalance in gro_cells

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <547630af-642c-49f9-b511-bd45dd65e20f@kernel.org>
Date: Mon, 20 Oct 2025 17:53:39 -0600
From: David Ahern <dsahern@...nel.org>
To: Eric Dumazet <edumazet@...gle.com>, "David S . Miller"
 <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>, Kuniyuki Iwashima <kuniyu@...gle.com>,
 netdev@...r.kernel.org, eric.dumazet@...il.com,
 syzbot+f9651b9a8212e1c8906f@...kaller.appspotmail.com,
 Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Subject: Re: [PATCH net] net: gro_cells: fix lock imbalance in
 gro_cells_receive()

On 10/20/25 10:11 AM, Eric Dumazet wrote:
> syzbot found that the local_unlock_nested_bh() call was
> missing in some cases.
> 
> WARNING: possible recursive locking detected
> syzkaller #0 Not tainted
> --------------------------------------------
> syz.2.329/7421 is trying to acquire lock:
>  ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
>  ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: gro_cells_receive+0x404/0x790 net/core/gro_cells.c:30
> 
> but task is already holding lock:
>  ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
>  ffffe8ffffd48888 ((&cell->bh_lock)){+...}-{3:3}, at: gro_cells_receive+0x404/0x790 net/core/gro_cells.c:30
> 
> other info that might help us debug this:
>  Possible unsafe locking scenario:
> 
>        CPU0
>        ----
>   lock((&cell->bh_lock));
>   lock((&cell->bh_lock));
> 
>  *** DEADLOCK ***
> 
> Given the introduction of @have_bh_lock variable, it seems the author
> intent was to have the local_unlock_nested_bh() after the @unlock label.
> 
> Fixes: 25718fdcbdd2 ("net: gro_cells: Use nested-BH locking for gro_cell")
> Reported-by: syzbot+f9651b9a8212e1c8906f@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/68f65eb9.a70a0220.205af.0034.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> ---
>  net/core/gro_cells.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@...nel.org>