Re: [syzbot] Re: BUG: corrupted list in ieee802154_if_remove()

[syzbot <syzbot+985f827280dc3a6e7e92@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: BUG: corrupted list in ieee802154_if_remove()
Author: dmantipov@yandex.ru

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git da4373fbcf006deda90e5e6a87c499e0ff747572

diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h
index 08dd521a51a5..52c8ea7f1da0 100644
--- a/net/mac802154/ieee802154_i.h
+++ b/net/mac802154/ieee802154_i.h
@@ -41,13 +41,11 @@ struct ieee802154_local {
 
 	/* As in mac80211 slaves list is modified:
 	 * 1) under the RTNL
-	 * 2) protected by slaves_mtx;
 	 * 3) in an RCU manner
 	 *
 	 * So atomic readers can use any of this protection methods.
 	 */
 	struct list_head	interfaces;
-	struct mutex		iflist_mtx;
 
 	/* Data related workqueue */
 	struct workqueue_struct	*workqueue;
@@ -101,6 +99,7 @@ enum {
 
 enum ieee802154_sdata_state_bits {
 	SDATA_STATE_RUNNING,
+	SDATA_STATE_REMOVING,
 };
 
 /* Slave interface definition.
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index c0e2da5072be..f4cbd5a8bb4e 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -668,9 +668,7 @@ ieee802154_if_add(struct ieee802154_local *local, const char *name,
 	if (ret < 0)
 		goto err;
 
-	mutex_lock(&local->iflist_mtx);
 	list_add_tail_rcu(&sdata->list, &local->interfaces);
-	mutex_unlock(&local->iflist_mtx);
 
 	return ndev;
 
@@ -683,25 +681,37 @@ void ieee802154_if_remove(struct ieee802154_sub_if_data *sdata)
 {
 	ASSERT_RTNL();
 
-	mutex_lock(&sdata->local->iflist_mtx);
-	list_del_rcu(&sdata->list);
-	mutex_unlock(&sdata->local->iflist_mtx);
-
-	synchronize_rcu();
-	unregister_netdevice(sdata->dev);
+	if (!test_and_set_bit(SDATA_STATE_REMOVING, &sdata->state)) {
+		list_del_rcu(&sdata->list);
+		unregister_netdevice(sdata->dev);
+	}
 }
 
+#define list_for_each_rcu_safe(pos, n, head) \
+	for (pos = rcu_dereference((head)->next), n = pos->next; \
+	     !list_is_head(pos, (head)); \
+	     pos = n, n = rcu_dereference(pos->next))
+
 void ieee802154_remove_interfaces(struct ieee802154_local *local)
 {
-	struct ieee802154_sub_if_data *sdata, *tmp;
+	struct ieee802154_sub_if_data *sdata;
+	struct list_head *entry, *tmp;
+	LIST_HEAD(head);
+
+	rcu_read_lock();
+
+	list_for_each_rcu_safe(entry, tmp, &local->interfaces) {
+		sdata = container_of(entry, struct ieee802154_sub_if_data, list);
+		if (!test_and_set_bit(SDATA_STATE_REMOVING, &sdata->state))
+			list_move(&sdata->list, &head);
+	}
 
-	mutex_lock(&local->iflist_mtx);
-	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
-		list_del(&sdata->list);
+	rcu_read_unlock();
 
+	list_for_each_safe(entry, tmp, &head) {
+		sdata = container_of(entry, struct ieee802154_sub_if_data, list);
 		unregister_netdevice(sdata->dev);
 	}
-	mutex_unlock(&local->iflist_mtx);
 }
 
 static int netdev_notify(struct notifier_block *nb,
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
index 21b7c3b280b4..61b6c5e06177 100644
--- a/net/mac802154/main.c
+++ b/net/mac802154/main.c
@@ -91,7 +91,6 @@ ieee802154_alloc_hw(size_t priv_data_len, const struct ieee802154_ops *ops)
 	INIT_LIST_HEAD(&local->interfaces);
 	INIT_LIST_HEAD(&local->rx_beacon_list);
 	INIT_LIST_HEAD(&local->rx_mac_cmd_list);
-	mutex_init(&local->iflist_mtx);
 
 	tasklet_setup(&local->tasklet, ieee802154_tasklet_handler);
 
@@ -174,8 +173,6 @@ void ieee802154_free_hw(struct ieee802154_hw *hw)
 
 	BUG_ON(!list_empty(&local->interfaces));
 
-	mutex_destroy(&local->iflist_mtx);
-
 	wpan_phy_free(local->phy);
 }
 EXPORT_SYMBOL(ieee802154_free_hw);