linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind
@ 2026-08-25 15:21 Khawar Ahemad
  2026-08-25 15:39 ` Daniel Borkmann
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Khawar Ahemad @ 2026-08-25 15:21 UTC (permalink / raw)
  To: bpf, netdev
  Cc: linux-kernel, magnus.karlsson, maciej.fijalkowski, sdf, ast,
	daniel, kuba, pabeni, syzbot+aa48b5fe7bfda62d1682,
	ahemadkhawar123

syzbot reported a circular locking dependency involving &net->xdp.lock,
&xs->mutex, and netdev_lock_ops():

-> #3 (&net->xdp.lock):
       xsk_notifier
       unregister_netdevice_many_notify
       rtnl_dellink

-> #2 (&port->pnodes_lock / netdev_lock):
       ipvlan_device_event / bond / netdev_change_features

-> #1 (netdev_lock_ops):
       xsk_bind (holds xs->mutex, takes netdev_lock_ops(dev))

-> #0 (&xs->mutex):
       xsk_diag_dump (holds net->xdp.lock, takes xs->mutex)

In xsk_bind(), xs->mutex was acquired before dev_get_by_index() and
netdev_lock_ops(dev). However, in netdev notifier callbacks like
xsk_notifier(), netdev_lock_ops(dev) is held by the netdev core while
taking net->xdp.lock and then xs->mutex, creating an ABBA lock
inversion between xs->mutex and netdev_lock_ops(dev).

Fix this by looking up the target net_device and acquiring
netdev_lock_ops(dev) before acquiring xs->mutex in xsk_bind(). This
aligns xsk_bind() with the global lock hierarchy:
rtnl_lock -> netdev_lock_ops(dev) -> net->xdp.lock -> xs->mutex.

Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")
Reported-by: syzbot+aa48b5fe7bfda62d1682@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aa48b5fe7bfda62d1682
Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
---
 net/xdp/xsk.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 7855ee09c4..d2fbbeb7b6 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -1612,19 +1612,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
 		return -EINVAL;
 
 	rtnl_lock();
-	mutex_lock(&xs->mutex);
-	if (xs->state != XSK_READY) {
-		err = -EBUSY;
-		goto out_release;
-	}
-
 	dev = dev_get_by_index(sock_net(sk), sxdp->sxdp_ifindex);
 	if (!dev) {
 		err = -ENODEV;
-		goto out_release;
+		goto out_rtnl_unlock;
 	}
 
 	netdev_lock_ops(dev);
+	mutex_lock(&xs->mutex);
+	if (xs->state != XSK_READY) {
+		err = -EBUSY;
+		goto out_unlock;
+	}
 
 	if (!xs->rx && !xs->tx) {
 		err = -EINVAL;
@@ -1771,9 +1770,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
 		smp_wmb();
 		WRITE_ONCE(xs->state, XSK_BOUND);
 	}
-	netdev_unlock_ops(dev);
-out_release:
 	mutex_unlock(&xs->mutex);
+	netdev_unlock_ops(dev);
+out_rtnl_unlock:
 	rtnl_unlock();
 	return err;
 }
-- 
2.54.0 (Apple Git-157)


^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-08-25 20:07 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-25 15:21 [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind Khawar Ahemad
2026-08-25 15:39 ` Daniel Borkmann
2026-08-25 15:42 ` Khawar Ahemad
2026-08-25 16:21 ` bot+bpf-ci
2026-08-25 20:07 ` [syzbot ci] " syzbot ci

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).