netdev - Re: [PATCH] RDMA/core: flush gid_cache_wq WQ from disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <98907ad9-2f85-49ff-9baf-cff7fcbc3cbf@I-love.SAKURA.ne.jp>
Date: Sat, 20 Dec 2025 00:09:06 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Jason Gunthorpe <jgg@...dia.com>, Leon Romanovsky <leon@...nel.org>,
        Majd Dibbiny <majd@...lanox.com>, Doug Ledford <dledford@...hat.com>,
        Yuval Shaia <yshaia@...vell.com>,
        Bernard Metzler <bernard.metzler@...ux.dev>
Cc: OFED mailing list <linux-rdma@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH] RDMA/core: flush gid_cache_wq WQ from disable_device()

syzbot finally found a reproducer for this bug.
When this reproducer is executed, disable_device() cannot return.
Can you find what is happening?


Showing all locks held in the system:
3 locks held by kworker/u512:1/13:
 #0: ffff88dc003d9d48 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x4dd/0x560
 #1: ffffcc00c009fe40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x1e2/0x560
 #2: ffffffffa027de70 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x51/0x3f0
3 locks held by kworker/u513:0/88:
 #0: ffff88dc2c853d48 ((wq_completion)ib-unreg-wq){+.+.}-{0:0}, at: process_one_work+0x4dd/0x560
 #1: ffffcc00c0f1fe40 ((work_completion)(&device->unregistration_work)){+.+.}-{0:0}, at: process_one_work+0x1e2/0x560
 #2: ffff88dc2bc56700 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0xe4/0x180 [ib_core]
3 locks held by bash/1175:
 #0: ffff88dc02734420 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x79/0xf0
 #1: ffffffff9ff9f220 (rcu_read_lock){....}-{1:3}, at: __handle_sysrq+0x44/0x120
 #2: ffffffff9ff9f220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire.constprop.0+0x7/0x30

=============================================

[root@...alhost ~]# cat /proc/13/stack
[<0>] msleep+0x1b/0x30
[<0>] netdev_wait_allrefs_any+0x15a/0x220
[<0>] netdev_run_todo+0x188/0x3c0
[<0>] default_device_exit_batch+0x170/0x1c0
[<0>] ops_undo_list+0x10d/0x3b0
[<0>] cleanup_net+0x20b/0x3f0
[<0>] process_one_work+0x223/0x560
[<0>] worker_thread+0x1cb/0x3a0
[<0>] kthread+0xff/0x240
[<0>] ret_from_fork+0x23b/0x280
[<0>] ret_from_fork_asm+0x1a/0x30
[root@...alhost ~]# cat /proc/88/stack
[<0>] disable_device+0xb4/0x170 [ib_core]
[<0>] __ib_unregister_device+0x110/0x180 [ib_core]
[<0>] ib_unregister_work+0x19/0x30 [ib_core]
[<0>] process_one_work+0x223/0x560
[<0>] worker_thread+0x1cb/0x3a0
[<0>] kthread+0xff/0x240
[<0>] ret_from_fork+0x23b/0x280
[<0>] ret_from_fork_asm+0x1a/0x30

View attachment "repro.c" of type "text/plain" (6535 bytes)