Re: [syzbot] [hams?] possible deadlock in nr_rt_ioctl (2)

[Hillf Danton <hdanton@sina.com>]

> Date: Thu, 26 Jun 2025 06:33:30 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    09a0fa92e5b4 Merge tag 'selinux-pr-20250107' of git://git...
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=122714b0580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7bdfbaac3fbb90d6
> dashboard link: https://syzkaller.appspot.com/bug?extid=14afda08dc3484d5db82
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b8db0f980000

#syz test

--- x/net/netrom/nr_route.c
+++ y/net/netrom/nr_route.c
@@ -331,6 +331,7 @@ static int nr_del_node(ax25_address *cal
 		return -EINVAL;
 	}
 
+	spin_lock_bh(&nr_neigh_list_lock);
 	spin_lock_bh(&nr_node_list_lock);
 	nr_node_lock(nr_node);
 	for (i = 0; i < nr_node->count; i++) {
@@ -339,7 +340,7 @@ static int nr_del_node(ax25_address *cal
 			nr_neigh_put(nr_neigh);
 
 			if (nr_neigh->count == 0 && !nr_neigh->locked)
-				nr_remove_neigh(nr_neigh);
+				__nr_remove_neigh(nr_neigh);
 			nr_neigh_put(nr_neigh);
 
 			nr_node->count--;
@@ -361,6 +362,7 @@ static int nr_del_node(ax25_address *cal
 			}
 			nr_node_unlock(nr_node);
 			spin_unlock_bh(&nr_node_list_lock);
+			spin_unlock_bh(&nr_neigh_list_lock);
 
 			return 0;
 		}
@@ -368,6 +370,7 @@ static int nr_del_node(ax25_address *cal
 	nr_neigh_put(nr_neigh);
 	nr_node_unlock(nr_node);
 	spin_unlock_bh(&nr_node_list_lock);
+	spin_unlock_bh(&nr_neigh_list_lock);
 	nr_node_put(nr_node);
 
 	return -EINVAL;
--