Re: [PATCH net-next] eth: bnxt: fix deadlock when xdp is attached or detached

[Simon Horman <horms@kernel.org>]

On Tue, May 20, 2025 at 07:11:55AM +0000, Taehee Yoo wrote:
> When xdp is attached or detached, dev->ndo_bpf() is called by
> do_setlink(), and it acquires netdev_lock() if needed.
> Unlike other drivers, the bnxt driver is protected by netdev_lock while
> xdp is attached/detached because it sets dev->request_ops_lock to true.
> 
> So, the bnxt_xdp(), that is callback of ->ndo_bpf should not acquire
> netdev_lock().
> But the xdp_features_{set | clear}_redirect_target() was changed to
> acquire netdev_lock() internally.
> It causes a deadlock.
> To fix this problem, bnxt driver should use
> xdp_features_{set | clear}_redirect_target_locked() instead.
> 
> Splat looks like:
> ============================================
> WARNING: possible recursive locking detected
> 6.15.0-rc6+ #1 Not tainted
> --------------------------------------------
> bpftool/1745 is trying to acquire lock:
> ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: xdp_features_set_redirect_target+0x1f/0x80
> 
> but task is already holding lock:
> ffff888131b85038 (&dev->lock){+.+.}-{4:4}, at: do_setlink.constprop.0+0x24e/0x35d0
> 
> other info that might help us debug this:
>  Possible unsafe locking scenario:
> 
>        CPU0
>        ----
>   lock(&dev->lock);
>   lock(&dev->lock);
> 
>  *** DEADLOCK ***

...

> 
> Fixes: 03df156dd3a6 ("xdp: double protect netdev->xdp_flags with netdev->lock")
> Signed-off-by: Taehee Yoo <ap420073@gmail.com>
> ---
> 
> This is a bugfix patch but target branch is net-next because the cause
> commit is not yet merged to net.

Reviewed-by: Simon Horman <horms@kernel.org>