[PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

[PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

[Khawar Ahemad]

syzbot reported a circular locking dependency involving &net->xdp.lock,
&xs->mutex, and netdev_lock_ops():

-> #3 (&net->xdp.lock):
       xsk_notifier
       unregister_netdevice_many_notify
       rtnl_dellink

-> #2 (&port->pnodes_lock / netdev_lock):
       ipvlan_device_event / bond / netdev_change_features

-> #1 (netdev_lock_ops):
       xsk_bind (holds xs->mutex, takes netdev_lock_ops(dev))

-> #0 (&xs->mutex):
       xsk_diag_dump (holds net->xdp.lock, takes xs->mutex)

In xsk_bind(), xs->mutex was acquired before dev_get_by_index() and
netdev_lock_ops(dev). However, in netdev notifier callbacks like
xsk_notifier(), netdev_lock_ops(dev) is held by the netdev core while
taking net->xdp.lock and then xs->mutex, creating an ABBA lock
inversion between xs->mutex and netdev_lock_ops(dev).

Fix this by looking up the target net_device and acquiring
netdev_lock_ops(dev) before acquiring xs->mutex in xsk_bind(). This
aligns xsk_bind() with the global lock hierarchy:
rtnl_lock -> netdev_lock_ops(dev) -> net->xdp.lock -> xs->mutex.

Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")
Reported-by: syzbot+aa48b5fe7bfda62d1682@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aa48b5fe7bfda62d1682
Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
---
 net/xdp/xsk.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 7855ee09c4..d2fbbeb7b6 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -1612,19 +1612,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
 		return -EINVAL;
 
 	rtnl_lock();
-	mutex_lock(&xs->mutex);
-	if (xs->state != XSK_READY) {
-		err = -EBUSY;
-		goto out_release;
-	}
-
 	dev = dev_get_by_index(sock_net(sk), sxdp->sxdp_ifindex);
 	if (!dev) {
 		err = -ENODEV;
-		goto out_release;
+		goto out_rtnl_unlock;
 	}
 
 	netdev_lock_ops(dev);
+	mutex_lock(&xs->mutex);
+	if (xs->state != XSK_READY) {
+		err = -EBUSY;
+		goto out_unlock;
+	}
 
 	if (!xs->rx && !xs->tx) {
 		err = -EINVAL;
@@ -1771,9 +1770,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
 		smp_wmb();
 		WRITE_ONCE(xs->state, XSK_BOUND);
 	}
-	netdev_unlock_ops(dev);
-out_release:
 	mutex_unlock(&xs->mutex);
+	netdev_unlock_ops(dev);
+out_rtnl_unlock:
 	rtnl_unlock();
 	return err;
 }
-- 
2.54.0 (Apple Git-157)

Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

[Daniel Borkmann]

On 8/25/26 5:21 PM, Khawar Ahemad wrote:
> syzbot reported a circular locking dependency involving &net->xdp.lock,
> &xs->mutex, and netdev_lock_ops():
> 
> -> #3 (&net->xdp.lock):
>         xsk_notifier
>         unregister_netdevice_many_notify
>         rtnl_dellink
> 
> -> #2 (&port->pnodes_lock / netdev_lock):
>         ipvlan_device_event / bond / netdev_change_features
> 
> -> #1 (netdev_lock_ops):
>         xsk_bind (holds xs->mutex, takes netdev_lock_ops(dev))
> 
> -> #0 (&xs->mutex):
>         xsk_diag_dump (holds net->xdp.lock, takes xs->mutex)
> 
> In xsk_bind(), xs->mutex was acquired before dev_get_by_index() and
> netdev_lock_ops(dev). However, in netdev notifier callbacks like
> xsk_notifier(), netdev_lock_ops(dev) is held by the netdev core while
> taking net->xdp.lock and then xs->mutex, creating an ABBA lock
> inversion between xs->mutex and netdev_lock_ops(dev).
> 
> Fix this by looking up the target net_device and acquiring
> netdev_lock_ops(dev) before acquiring xs->mutex in xsk_bind(). This
> aligns xsk_bind() with the global lock hierarchy:
> rtnl_lock -> netdev_lock_ops(dev) -> net->xdp.lock -> xs->mutex.
> 
> Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")
> Reported-by: syzbot+aa48b5fe7bfda62d1682@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aa48b5fe7bfda62d1682
> Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>

This creates a deadlock with the change in the following:

  - xsk_bind() takes dev->lock -> xs->mutex
  - xsk_notifier() -> xp_clear_dev() takes xs->mutex -> dev->lock

... also Fixes tag does not exist.

Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

[Khawar Ahemad]

Hi Daniel,

Thank you for the quick review and pointer. You are completely right —
I missed that xsk_notifier() calls xp_clear_dev() while holding xs->mutex,
which acquires netdev_lock_ops() internally.

Please drop this patch. I will step back and do a more thorough analysis
of the full locking design between xs->mutex, net->xdp.lock, and
xp_clear_dev().

Thanks,
Khawar Ahemad <ahemadkhawar123@gmail.com>

Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2229 bytes --]

> diff --git net/xdp/xsk.c net/xdp/xsk.c
> index 7855ee09c4b6..d2fbbeb7b6d7 100644
> --- net/xdp/xsk.c
> +++ net/xdp/xsk.c
> @@ -1612,19 +1612,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
>  		return -EINVAL;
>
>  	rtnl_lock();
> -	mutex_lock(&xs->mutex);
> -	if (xs->state != XSK_READY) {
> -		err = -EBUSY;
> -		goto out_release;
> -	}
> -
>  	dev = dev_get_by_index(sock_net(sk), sxdp->sxdp_ifindex);
>  	if (!dev) {
>  		err = -ENODEV;
> -		goto out_release;
> +		goto out_rtnl_unlock;
>  	}
>
>  	netdev_lock_ops(dev);
> +	mutex_lock(&xs->mutex);
> +	if (xs->state != XSK_READY) {
> +		err = -EBUSY;
> +		goto out_unlock;
> +	}

Does this reordering change the errno precedence userspace sees?

Before the patch, bind() on an already-bound socket (state != XSK_READY)
returned -EBUSY regardless of whether the ifindex was valid. After the
patch, the same call returns -ENODEV if the ifindex lookup fails, because
dev_get_by_index() is now checked before the state test.

If preserving the -EBUSY precedence matters for userspace compatibility,
would the state check need to stay ahead of dev_get_by_index()?

[ ... ]

> @@ -1771,9 +1770,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
>  		smp_wmb();
>  		WRITE_ONCE(xs->state, XSK_BOUND);
>  	}
> -	netdev_unlock_ops(dev);
> -out_release:
>  	mutex_unlock(&xs->mutex);
> +	netdev_unlock_ops(dev);
> +out_rtnl_unlock:
>  	rtnl_unlock();
>  	return err;
>  }

Looking at the commit message:

>     Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")

The Fixes tag references commit 978939c08db1, but this commit does not exist
in this repository. Running git log and searching lore shows no commit with
this SHA or subject line. The tag appears to be fabricated.

The buggy locking pattern was actually introduced in commit 975b11ae9077
when net/xdp/xsk.c was first added to this repository. Should the Fixes
tag reference that commit instead?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32867683423

[syzbot ci] Re: xsk: Fix circular locking dependency in xsk_bind

[syzbot ci]

syzbot ci has tested the following series

[v1] xsk: Fix circular locking dependency in xsk_bind
https://lore.kernel.org/all/20260825152152.86092-1-ahemadkhawar123@gmail.com
* [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

and found the following issue:
possible deadlock in xp_clear_dev

Full report is available here:
https://ci.syzbot.org/series/6f095c15-0f05-4d2e-a9eb-8d4d85f669a6

***

possible deadlock in xp_clear_dev

tree:      bpf-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/bpf/bpf-next.git
base:      5e289c5a4a526e870efac0ca658635c47138593a
arch:      amd64
compiler:  Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config:    https://ci.syzbot.org/builds/cde9ebbb-b104-4fe4-8779-17786d4f4336/config
syz repro: https://ci.syzbot.org/findings/bb56c4f2-d20c-4177-a137-583624105374/syz_repro

netlink: 14 bytes leftover after parsing attributes in process `syz.0.17'.
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/5789 is trying to acquire lock:
ffff88816f80ee70 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline]
ffff88816f80ee70 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
ffff88816f80ee70 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: xp_clear_dev+0x13b/0x340 net/xdp/xsk_buff_pool.c:297

but task is already holding lock:
ffff8881741d06b8 (&xs->mutex){+.+.}-{4:4}, at: xsk_notifier+0xcd/0x230 net/xdp/xsk.c:2109

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #1 (&xs->mutex){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       xsk_bind+0x2c0/0x1370 net/xdp/xsk.c:1622
       __sys_bind_socket net/socket.c:1945 [inline]
       __sys_bind+0x2e3/0x410 net/socket.c:1976
       __do_sys_bind net/socket.c:1981 [inline]
       __se_sys_bind net/socket.c:1979 [inline]
       __x64_sys_bind+0x7a/0x90 net/socket.c:1979
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&dev_instance_lock_key#3){+.+.}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3181 [inline]
       check_prevs_add kernel/locking/lockdep.c:3300 [inline]
       validate_chain kernel/locking/lockdep.c:3924 [inline]
       __lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5253
       lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
       __mutex_lock_common kernel/locking/mutex.c:646 [inline]
       __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
       netdev_lock include/linux/netdevice.h:2861 [inline]
       netdev_lock_ops include/net/netdev_lock.h:42 [inline]
       xp_clear_dev+0x13b/0x340 net/xdp/xsk_buff_pool.c:297
       xsk_notifier+0x1a1/0x230 net/xdp/xsk.c:2118
       notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
       call_netdevice_notifiers net/core/dev.c:2327 [inline]
       unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
       rtnl_delete_link net/core/rtnetlink.c:3652 [inline]
       rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3694
       rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
       netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
       netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
       netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
       sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
       __sock_sendmsg net/socket.c:815 [inline]
       ____sys_sendmsg+0x54e/0x850 net/socket.c:2713
       ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
       __sys_sendmsg net/socket.c:2799 [inline]
       __do_sys_sendmsg net/socket.c:2804 [inline]
       __se_sys_sendmsg net/socket.c:2802 [inline]
       __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&xs->mutex);
                               lock(&dev_instance_lock_key#3);
                               lock(&xs->mutex);
  lock(&dev_instance_lock_key#3);

 *** DEADLOCK ***

locks held by syz.0.17/5789: 3, last CPU#1:
 #0: ffffffff90036040 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff90036040 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #0: ffffffff90036040 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x41b/0x810 net/core/rtnetlink.c:3686
 #1: ffff88801d81eed0 (&net->xdp.lock){+.+.}-{4:4}, at: xsk_notifier+0x89/0x230 net/xdp/xsk.c:2105
 #2: ffff8881741d06b8 (&xs->mutex){+.+.}-{4:4}, at: xsk_notifier+0xcd/0x230 net/xdp/xsk.c:2109

stack backtrace:
CPU: 1 UID: 0 PID: 5789 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2059
 check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2191
 check_prev_add kernel/locking/lockdep.c:3181 [inline]
 check_prevs_add kernel/locking/lockdep.c:3300 [inline]
 validate_chain kernel/locking/lockdep.c:3924 [inline]
 __lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5253
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
 __mutex_lock_common kernel/locking/mutex.c:646 [inline]
 __mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
 netdev_lock include/linux/netdevice.h:2861 [inline]
 netdev_lock_ops include/net/netdev_lock.h:42 [inline]
 xp_clear_dev+0x13b/0x340 net/xdp/xsk_buff_pool.c:297
 xsk_notifier+0x1a1/0x230 net/xdp/xsk.c:2118
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
 rtnl_delete_link net/core/rtnetlink.c:3652 [inline]
 rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3694
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2713
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2ec039e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2ec1214028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2ec0625fa0 RCX: 00007f2ec039e0d9
RDX: 0000000004048004 RSI: 00002000000001c0 RDI: 0000000000000005
RBP: 00007f2ec0435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2ec0626038 R14: 00007f2ec0625fa0 R15: 00007ffca00aa538
 </TASK>


***

If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
  Tested-by: syzbot@syzkaller.appspotmail.com

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.

To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.

Notes:
- The patch will be applied on top of the tested series (as an
  incremental fix).
- To test a new version of the whole series, please send it directly
  to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.