* Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind
2026-08-25 15:21 [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind Khawar Ahemad
@ 2026-08-25 15:39 ` Daniel Borkmann
2026-08-25 15:42 ` Khawar Ahemad
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Daniel Borkmann @ 2026-08-25 15:39 UTC (permalink / raw)
To: Khawar Ahemad, bpf, netdev
Cc: linux-kernel, magnus.karlsson, maciej.fijalkowski, sdf, ast, kuba,
pabeni, syzbot+aa48b5fe7bfda62d1682
On 8/25/26 5:21 PM, Khawar Ahemad wrote:
> syzbot reported a circular locking dependency involving &net->xdp.lock,
> &xs->mutex, and netdev_lock_ops():
>
> -> #3 (&net->xdp.lock):
> xsk_notifier
> unregister_netdevice_many_notify
> rtnl_dellink
>
> -> #2 (&port->pnodes_lock / netdev_lock):
> ipvlan_device_event / bond / netdev_change_features
>
> -> #1 (netdev_lock_ops):
> xsk_bind (holds xs->mutex, takes netdev_lock_ops(dev))
>
> -> #0 (&xs->mutex):
> xsk_diag_dump (holds net->xdp.lock, takes xs->mutex)
>
> In xsk_bind(), xs->mutex was acquired before dev_get_by_index() and
> netdev_lock_ops(dev). However, in netdev notifier callbacks like
> xsk_notifier(), netdev_lock_ops(dev) is held by the netdev core while
> taking net->xdp.lock and then xs->mutex, creating an ABBA lock
> inversion between xs->mutex and netdev_lock_ops(dev).
>
> Fix this by looking up the target net_device and acquiring
> netdev_lock_ops(dev) before acquiring xs->mutex in xsk_bind(). This
> aligns xsk_bind() with the global lock hierarchy:
> rtnl_lock -> netdev_lock_ops(dev) -> net->xdp.lock -> xs->mutex.
>
> Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")
> Reported-by: syzbot+aa48b5fe7bfda62d1682@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aa48b5fe7bfda62d1682
> Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
This creates a deadlock with the change in the following:
- xsk_bind() takes dev->lock -> xs->mutex
- xsk_notifier() -> xp_clear_dev() takes xs->mutex -> dev->lock
... also Fixes tag does not exist.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind
2026-08-25 15:21 [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind Khawar Ahemad
2026-08-25 15:39 ` Daniel Borkmann
@ 2026-08-25 15:42 ` Khawar Ahemad
2026-08-25 16:21 ` bot+bpf-ci
2026-08-25 20:07 ` [syzbot ci] " syzbot ci
3 siblings, 0 replies; 5+ messages in thread
From: Khawar Ahemad @ 2026-08-25 15:42 UTC (permalink / raw)
To: daniel
Cc: bpf, netdev, linux-kernel, magnus.karlsson, maciej.fijalkowski,
sdf, ast, kuba, pabeni, syzbot+aa48b5fe7bfda62d1682
Hi Daniel,
Thank you for the quick review and pointer. You are completely right —
I missed that xsk_notifier() calls xp_clear_dev() while holding xs->mutex,
which acquires netdev_lock_ops() internally.
Please drop this patch. I will step back and do a more thorough analysis
of the full locking design between xs->mutex, net->xdp.lock, and
xp_clear_dev().
Thanks,
Khawar Ahemad <ahemadkhawar123@gmail.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind
2026-08-25 15:21 [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind Khawar Ahemad
2026-08-25 15:39 ` Daniel Borkmann
2026-08-25 15:42 ` Khawar Ahemad
@ 2026-08-25 16:21 ` bot+bpf-ci
2026-08-25 20:07 ` [syzbot ci] " syzbot ci
3 siblings, 0 replies; 5+ messages in thread
From: bot+bpf-ci @ 2026-08-25 16:21 UTC (permalink / raw)
To: ahemadkhawar123, bpf, netdev
Cc: linux-kernel, magnus.karlsson, maciej.fijalkowski, sdf, ast,
daniel, kuba, pabeni, syzbot+aa48b5fe7bfda62d1682,
ahemadkhawar123, ast, andrii, daniel, martin.lau, eddyz87,
yonghong.song, clm, ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 2229 bytes --]
> diff --git net/xdp/xsk.c net/xdp/xsk.c
> index 7855ee09c4b6..d2fbbeb7b6d7 100644
> --- net/xdp/xsk.c
> +++ net/xdp/xsk.c
> @@ -1612,19 +1612,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
> return -EINVAL;
>
> rtnl_lock();
> - mutex_lock(&xs->mutex);
> - if (xs->state != XSK_READY) {
> - err = -EBUSY;
> - goto out_release;
> - }
> -
> dev = dev_get_by_index(sock_net(sk), sxdp->sxdp_ifindex);
> if (!dev) {
> err = -ENODEV;
> - goto out_release;
> + goto out_rtnl_unlock;
> }
>
> netdev_lock_ops(dev);
> + mutex_lock(&xs->mutex);
> + if (xs->state != XSK_READY) {
> + err = -EBUSY;
> + goto out_unlock;
> + }
Does this reordering change the errno precedence userspace sees?
Before the patch, bind() on an already-bound socket (state != XSK_READY)
returned -EBUSY regardless of whether the ifindex was valid. After the
patch, the same call returns -ENODEV if the ifindex lookup fails, because
dev_get_by_index() is now checked before the state test.
If preserving the -EBUSY precedence matters for userspace compatibility,
would the state check need to stay ahead of dev_get_by_index()?
[ ... ]
> @@ -1771,9 +1770,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
> smp_wmb();
> WRITE_ONCE(xs->state, XSK_BOUND);
> }
> - netdev_unlock_ops(dev);
> -out_release:
> mutex_unlock(&xs->mutex);
> + netdev_unlock_ops(dev);
> +out_rtnl_unlock:
> rtnl_unlock();
> return err;
> }
Looking at the commit message:
> Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")
The Fixes tag references commit 978939c08db1, but this commit does not exist
in this repository. Running git log and searching lore shows no commit with
this SHA or subject line. The tag appears to be fabricated.
The buggy locking pattern was actually introduced in commit 975b11ae9077
when net/xdp/xsk.c was first added to this repository. Should the Fixes
tag reference that commit instead?
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32867683423
^ permalink raw reply [flat|nested] 5+ messages in thread* [syzbot ci] Re: xsk: Fix circular locking dependency in xsk_bind
2026-08-25 15:21 [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind Khawar Ahemad
` (2 preceding siblings ...)
2026-08-25 16:21 ` bot+bpf-ci
@ 2026-08-25 20:07 ` syzbot ci
3 siblings, 0 replies; 5+ messages in thread
From: syzbot ci @ 2026-08-25 20:07 UTC (permalink / raw)
To: ahemadkhawar123, ast, bpf, daniel, kuba, linux-kernel,
maciej.fijalkowski, magnus.karlsson, netdev, pabeni, sdf, syzbot
Cc: syzbot, syzkaller-bugs
syzbot ci has tested the following series
[v1] xsk: Fix circular locking dependency in xsk_bind
https://lore.kernel.org/all/20260825152152.86092-1-ahemadkhawar123@gmail.com
* [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind
and found the following issue:
possible deadlock in xp_clear_dev
Full report is available here:
https://ci.syzbot.org/series/6f095c15-0f05-4d2e-a9eb-8d4d85f669a6
***
possible deadlock in xp_clear_dev
tree: bpf-next
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/bpf/bpf-next.git
base: 5e289c5a4a526e870efac0ca658635c47138593a
arch: amd64
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config: https://ci.syzbot.org/builds/cde9ebbb-b104-4fe4-8779-17786d4f4336/config
syz repro: https://ci.syzbot.org/findings/bb56c4f2-d20c-4177-a137-583624105374/syz_repro
netlink: 14 bytes leftover after parsing attributes in process `syz.0.17'.
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Not tainted
------------------------------------------------------
syz.0.17/5789 is trying to acquire lock:
ffff88816f80ee70 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2861 [inline]
ffff88816f80ee70 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
ffff88816f80ee70 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: xp_clear_dev+0x13b/0x340 net/xdp/xsk_buff_pool.c:297
but task is already holding lock:
ffff8881741d06b8 (&xs->mutex){+.+.}-{4:4}, at: xsk_notifier+0xcd/0x230 net/xdp/xsk.c:2109
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&xs->mutex){+.+.}-{4:4}:
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
xsk_bind+0x2c0/0x1370 net/xdp/xsk.c:1622
__sys_bind_socket net/socket.c:1945 [inline]
__sys_bind+0x2e3/0x410 net/socket.c:1976
__do_sys_bind net/socket.c:1981 [inline]
__se_sys_bind net/socket.c:1979 [inline]
__x64_sys_bind+0x7a/0x90 net/socket.c:1979
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&dev_instance_lock_key#3){+.+.}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5253
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
netdev_lock include/linux/netdevice.h:2861 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
xp_clear_dev+0x13b/0x340 net/xdp/xsk_buff_pool.c:297
xsk_notifier+0x1a1/0x230 net/xdp/xsk.c:2118
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
call_netdevice_notifiers net/core/dev.c:2327 [inline]
unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
rtnl_delete_link net/core/rtnetlink.c:3652 [inline]
rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3694
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
__sock_sendmsg net/socket.c:815 [inline]
____sys_sendmsg+0x54e/0x850 net/socket.c:2713
___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
__sys_sendmsg net/socket.c:2799 [inline]
__do_sys_sendmsg net/socket.c:2804 [inline]
__se_sys_sendmsg net/socket.c:2802 [inline]
__x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&xs->mutex);
lock(&dev_instance_lock_key#3);
lock(&xs->mutex);
lock(&dev_instance_lock_key#3);
*** DEADLOCK ***
locks held by syz.0.17/5789: 3, last CPU#1:
#0: ffffffff90036040 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#0: ffffffff90036040 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
#0: ffffffff90036040 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x41b/0x810 net/core/rtnetlink.c:3686
#1: ffff88801d81eed0 (&net->xdp.lock){+.+.}-{4:4}, at: xsk_notifier+0x89/0x230 net/xdp/xsk.c:2105
#2: ffff8881741d06b8 (&xs->mutex){+.+.}-{4:4}, at: xsk_notifier+0xcd/0x230 net/xdp/xsk.c:2109
stack backtrace:
CPU: 1 UID: 0 PID: 5789 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_circular_bug+0x2e1/0x300 kernel/locking/lockdep.c:2059
check_noncircular+0x12e/0x150 kernel/locking/lockdep.c:2191
check_prev_add kernel/locking/lockdep.c:3181 [inline]
check_prevs_add kernel/locking/lockdep.c:3300 [inline]
validate_chain kernel/locking/lockdep.c:3924 [inline]
__lock_acquire+0x1520/0x2cf0 kernel/locking/lockdep.c:5253
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
__mutex_lock_common kernel/locking/mutex.c:646 [inline]
__mutex_lock+0x19d/0x1550 kernel/locking/mutex.c:821
netdev_lock include/linux/netdevice.h:2861 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
xp_clear_dev+0x13b/0x340 net/xdp/xsk_buff_pool.c:297
xsk_notifier+0x1a1/0x230 net/xdp/xsk.c:2118
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
call_netdevice_notifiers net/core/dev.c:2327 [inline]
unregister_netdevice_many_notify+0x17f9/0x2140 net/core/dev.c:12518
rtnl_delete_link net/core/rtnetlink.c:3652 [inline]
rtnl_dellink+0x5be/0x810 net/core/rtnetlink.c:3694
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
__sock_sendmsg net/socket.c:815 [inline]
____sys_sendmsg+0x54e/0x850 net/socket.c:2713
___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
__sys_sendmsg net/socket.c:2799 [inline]
__do_sys_sendmsg net/socket.c:2804 [inline]
__se_sys_sendmsg net/socket.c:2802 [inline]
__x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2802
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2ec039e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2ec1214028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2ec0625fa0 RCX: 00007f2ec039e0d9
RDX: 0000000004048004 RSI: 00002000000001c0 RDI: 0000000000000005
RBP: 00007f2ec0435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2ec0626038 R14: 00007f2ec0625fa0 R15: 00007ffca00aa538
</TASK>
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.
Notes:
- The patch will be applied on top of the tested series (as an
incremental fix).
- To test a new version of the whole series, please send it directly
to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.
^ permalink raw reply [flat|nested] 5+ messages in thread