* [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
@ 2025-06-12 2:21 syzbot
2025-06-13 1:09 ` Stanislav Fomichev
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: syzbot @ 2025-06-12 2:21 UTC (permalink / raw)
To: davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: f09079bd04a9 Merge tag 'powerpc-6.16-2' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16e9260c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e24211089078d6c6
dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f09079bd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ef68cb3d29a3/vmlinux-f09079bd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1cc9431b9a15/bzImage-f09079bd.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b8c48ea38ca27d150063@syzkaller.appspotmail.com
------------[ cut here ]------------
RTNL: assertion failed at ./include/net/netdev_lock.h (72)
WARNING: CPU: 0 PID: 1141 at ./include/net/netdev_lock.h:72 netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
WARNING: CPU: 0 PID: 1141 at ./include/net/netdev_lock.h:72 __linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
Modules linked in:
CPU: 0 UID: 0 PID: 1141 Comm: kworker/u32:5 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bond0 bond_mii_monitor
RIP: 0010:netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
RIP: 0010:__linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
Code: 05 ff ff ff e8 64 d1 59 f8 c6 05 76 2e 2e 07 01 90 ba 48 00 00 00 48 c7 c6 c0 88 e3 8c 48 c7 c7 60 88 e3 8c e8 64 96 18 f8 90 <0f> 0b 90 90 e9 d6 fe ff ff 48 c7 c7 44 3e a8 90 e8 fe 8e c0 f8 e9
RSP: 0018:ffffc900064a79f0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880368fc000 RCX: ffffffff817ae368
RDX: ffff88802990a440 RSI: ffffffff817ae375 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff92000c94f48
R13: ffff8880368fccc5 R14: ffffffff8c5909c0 R15: ffffffff899b8950
FS: 0000000000000000(0000) GS:ffff8880d6754000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555560fdf808 CR3: 000000000e382000 CR4: 0000000000352ef0
DR0: 0000000010000007 DR1: 400000000000000c DR2: 0000000000000000
DR3: 0000000000000005 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:63
bond_check_dev_link+0x3f9/0x710 drivers/net/bonding/bond_main.c:863
bond_miimon_inspect drivers/net/bonding/bond_main.c:2745 [inline]
bond_mii_monitor+0x3c0/0x2dc0 drivers/net/bonding/bond_main.c:2967
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
2025-06-12 2:21 [syzbot] [net?] WARNING in __linkwatch_sync_dev (2) syzbot
@ 2025-06-13 1:09 ` Stanislav Fomichev
2025-06-13 23:56 ` Jakub Kicinski
2025-06-13 20:30 ` syzbot
2025-08-02 15:01 ` syzbot
2 siblings, 1 reply; 7+ messages in thread
From: Stanislav Fomichev @ 2025-06-13 1:09 UTC (permalink / raw)
To: syzbot
Cc: davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
On 06/11, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: f09079bd04a9 Merge tag 'powerpc-6.16-2' of git://git.kerne..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16e9260c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e24211089078d6c6
> dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f09079bd.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/ef68cb3d29a3/vmlinux-f09079bd.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/1cc9431b9a15/bzImage-f09079bd.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b8c48ea38ca27d150063@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> RTNL: assertion failed at ./include/net/netdev_lock.h (72)
> WARNING: CPU: -1 PID: 1141 at ./include/net/netdev_lock.h:72 netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
> WARNING: CPU: 0 PID: 1141 at ./include/net/netdev_lock.h:72 __linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
> ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:63
> bond_check_dev_link+0x3f9/0x710 drivers/net/bonding/bond_main.c:863
> bond_miimon_inspect drivers/net/bonding/bond_main.c:2745 [inline]
> bond_mii_monitor+0x3c0/0x2dc0 drivers/net/bonding/bond_main.c:2967
> process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
> process_scheduled_works kernel/workqueue.c:3321 [inline]
> worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
> kthread+0x3c5/0x780 kernel/kthread.c:464
> ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
netdev_ops_assert_locked is called for non-ops-locked netdev and we
trigger ASSERT_RTNL case. Which is a bit misleading, but I noticed that
bond_miimon_inspect is running under rcu lock, which is not
gonna work for ops-locked devices :-/ (we want to grab instance
lock for the CHANGE notifiers).
I'm contemplating dropping rcu and doing try_lock rtnl. Looking at
commit f0c76d61779b ("bonding: refactor mii monitor"), it doesn't look
like there were issues with rtnl performance, so hopefully should be ok.
Because from my resent patches I remember this trace:
[ 3456.656261] ? ipv6_add_dev+0x370/0x620
[ 3456.660039] ipv6_find_idev+0x96/0xe0
[ 3456.660445] addrconf_add_dev+0x1e/0xa0
[ 3456.660861] addrconf_init_auto_addrs+0xb0/0x720
[ 3456.661803] addrconf_notify+0x35f/0x8d0
[ 3456.662236] notifier_call_chain+0x38/0xf0
[ 3456.662676] netdev_state_change+0x65/0x90
[ 3456.663112] linkwatch_do_dev+0x5a/0x70
Where linkwatch_do_dev (potentially called from ethtool_op_get_link and
bond_check_dev_link) might trigger ipv6 address assignment so I'm not
sure how this all supposed to work under rcu and without rtnl lock.
Tentatively (untested uncompiled):
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c4d53e8e7c15..e2c4bcdb8b1a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2739,7 +2739,7 @@ static int bond_miimon_inspect(struct bonding *bond)
ignore_updelay = true;
}
- bond_for_each_slave_rcu(bond, slave, iter) {
+ bond_for_each_slave(bond, slave, iter) {
bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
link_state = bond_check_dev_link(bond, slave->dev, 0);
@@ -2962,35 +2962,28 @@ static void bond_mii_monitor(struct work_struct *work)
if (!bond_has_slaves(bond))
goto re_arm;
- rcu_read_lock();
+ /* Race avoidance with bond_close cancel of workqueue */
+ if (!rtnl_trylock()) {
+ delay = 1;
+ should_notify_peers = false;
+ goto re_arm;
+ }
+
should_notify_peers = bond_should_notify_peers(bond);
commit = !!bond_miimon_inspect(bond);
if (bond->send_peer_notif) {
- rcu_read_unlock();
- if (rtnl_trylock()) {
- bond->send_peer_notif--;
- rtnl_unlock();
- }
- } else {
- rcu_read_unlock();
+ bond->send_peer_notif--;
}
if (commit) {
- /* Race avoidance with bond_close cancel of workqueue */
- if (!rtnl_trylock()) {
- delay = 1;
- should_notify_peers = false;
- goto re_arm;
- }
-
bond_for_each_slave(bond, slave, iter) {
bond_commit_link_state(slave, BOND_SLAVE_NOTIFY_LATER);
}
bond_miimon_commit(bond);
-
- rtnl_unlock(); /* might sleep, hold no other locks */
}
+ rtnl_unlock(); /* might sleep, hold no other locks */
+
re_arm:
if (bond->params.miimon)
queue_delayed_work(bond->wq, &bond->mii_work, delay);
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
2025-06-12 2:21 [syzbot] [net?] WARNING in __linkwatch_sync_dev (2) syzbot
2025-06-13 1:09 ` Stanislav Fomichev
@ 2025-06-13 20:30 ` syzbot
2025-06-16 15:54 ` Stanislav Fomichev
2025-08-02 15:01 ` syzbot
2 siblings, 1 reply; 7+ messages in thread
From: syzbot @ 2025-06-13 20:30 UTC (permalink / raw)
To: davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
stfomichev, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 27605c8c0f69 Merge tag 'net-6.16-rc2' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17bb9d70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8e5a54165d499a9
dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a7b9d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1421310c580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-27605c8c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ab939a8a93b4/vmlinux-27605c8c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e90d45016aac/bzImage-27605c8c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b8c48ea38ca27d150063@syzkaller.appspotmail.com
------------[ cut here ]------------
RTNL: assertion failed at ./include/net/netdev_lock.h (72)
WARNING: CPU: 2 PID: 60 at ./include/net/netdev_lock.h:72 netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
WARNING: CPU: 2 PID: 60 at ./include/net/netdev_lock.h:72 __linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
Modules linked in:
CPU: 2 UID: 0 PID: 60 Comm: kworker/u32:3 Not tainted 6.16.0-rc1-syzkaller-00101-g27605c8c0f69 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bond0 bond_mii_monitor
RIP: 0010:netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
RIP: 0010:__linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
Code: 05 ff ff ff e8 94 b6 59 f8 c6 05 e9 0f 2e 07 01 90 ba 48 00 00 00 48 c7 c6 c0 8c e3 8c 48 c7 c7 60 8c e3 8c e8 94 7b 18 f8 90 <0f> 0b 90 90 e9 d6 fe ff ff 48 c7 c7 44 3b a8 90 e8 ae 86 c0 f8 e9
RSP: 0018:ffffc90000ce79f0 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8880363a2000 RCX: ffffffff817ae368
RDX: ffff888022148000 RSI: ffffffff817ae375 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff9200019cf48
R13: ffff8880363a2cc5 R14: ffffffff8c5909c0 R15: ffffffff899ba310
FS: 0000000000000000(0000) GS:ffff8880d6954000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4122af9c CR3: 000000000e382000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:63
bond_check_dev_link+0x3f9/0x710 drivers/net/bonding/bond_main.c:863
bond_miimon_inspect drivers/net/bonding/bond_main.c:2745 [inline]
bond_mii_monitor+0x3c0/0x2dc0 drivers/net/bonding/bond_main.c:2967
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
2025-06-13 1:09 ` Stanislav Fomichev
@ 2025-06-13 23:56 ` Jakub Kicinski
0 siblings, 0 replies; 7+ messages in thread
From: Jakub Kicinski @ 2025-06-13 23:56 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: syzbot, davem, edumazet, horms, linux-kernel, netdev, pabeni,
syzkaller-bugs
On Thu, 12 Jun 2025 18:09:02 -0700 Stanislav Fomichev wrote:
> Where linkwatch_do_dev (potentially called from ethtool_op_get_link and
> bond_check_dev_link) might trigger ipv6 address assignment so I'm not
> sure how this all supposed to work under rcu and without rtnl lock.
Yeah, linkwatch seems to also try to allocate memory with GFP_KERNEL.
> Tentatively (untested uncompiled):
I think miimon recheck period may be rather frequent, but given
the above going back to rtnl is probably the sanest way out.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
2025-06-13 20:30 ` syzbot
@ 2025-06-16 15:54 ` Stanislav Fomichev
2025-06-16 16:07 ` syzbot
0 siblings, 1 reply; 7+ messages in thread
From: Stanislav Fomichev @ 2025-06-16 15:54 UTC (permalink / raw)
To: syzbot
Cc: davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
syzkaller-bugs
On 06/13, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 27605c8c0f69 Merge tag 'net-6.16-rc2' of git://git.kernel...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17bb9d70580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=8e5a54165d499a9
> dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a7b9d4580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1421310c580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-27605c8c.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/ab939a8a93b4/vmlinux-27605c8c.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/e90d45016aac/bzImage-27605c8c.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b8c48ea38ca27d150063@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> RTNL: assertion failed at ./include/net/netdev_lock.h (72)
> WARNING: CPU: 2 PID: 60 at ./include/net/netdev_lock.h:72 netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
> WARNING: CPU: 2 PID: 60 at ./include/net/netdev_lock.h:72 __linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
> Modules linked in:
> CPU: 2 UID: 0 PID: 60 Comm: kworker/u32:3 Not tainted 6.16.0-rc1-syzkaller-00101-g27605c8c0f69 #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: bond0 bond_mii_monitor
> RIP: 0010:netdev_ops_assert_locked include/net/netdev_lock.h:72 [inline]
> RIP: 0010:__linkwatch_sync_dev+0x1ed/0x230 net/core/link_watch.c:279
> Code: 05 ff ff ff e8 94 b6 59 f8 c6 05 e9 0f 2e 07 01 90 ba 48 00 00 00 48 c7 c6 c0 8c e3 8c 48 c7 c7 60 8c e3 8c e8 94 7b 18 f8 90 <0f> 0b 90 90 e9 d6 fe ff ff 48 c7 c7 44 3b a8 90 e8 ae 86 c0 f8 e9
> RSP: 0018:ffffc90000ce79f0 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: ffff8880363a2000 RCX: ffffffff817ae368
> RDX: ffff888022148000 RSI: ffffffff817ae375 RDI: 0000000000000001
> RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000001 R12: 1ffff9200019cf48
> R13: ffff8880363a2cc5 R14: ffffffff8c5909c0 R15: ffffffff899ba310
> FS: 0000000000000000(0000) GS:ffff8880d6954000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffd4122af9c CR3: 000000000e382000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> ethtool_op_get_link+0x1d/0x70 net/ethtool/ioctl.c:63
> bond_check_dev_link+0x3f9/0x710 drivers/net/bonding/bond_main.c:863
> bond_miimon_inspect drivers/net/bonding/bond_main.c:2745 [inline]
> bond_mii_monitor+0x3c0/0x2dc0 drivers/net/bonding/bond_main.c:2967
> process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
> process_scheduled_works kernel/workqueue.c:3321 [inline]
> worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
> kthread+0x3c5/0x780 kernel/kthread.c:464
> ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
#syz test
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c4d53e8e7c15..e2c4bcdb8b1a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2739,7 +2739,7 @@ static int bond_miimon_inspect(struct bonding *bond)
ignore_updelay = true;
}
- bond_for_each_slave_rcu(bond, slave, iter) {
+ bond_for_each_slave(bond, slave, iter) {
bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
link_state = bond_check_dev_link(bond, slave->dev, 0);
@@ -2962,35 +2962,28 @@ static void bond_mii_monitor(struct work_struct *work)
if (!bond_has_slaves(bond))
goto re_arm;
- rcu_read_lock();
+ /* Race avoidance with bond_close cancel of workqueue */
+ if (!rtnl_trylock()) {
+ delay = 1;
+ should_notify_peers = false;
+ goto re_arm;
+ }
+
should_notify_peers = bond_should_notify_peers(bond);
commit = !!bond_miimon_inspect(bond);
if (bond->send_peer_notif) {
- rcu_read_unlock();
- if (rtnl_trylock()) {
- bond->send_peer_notif--;
- rtnl_unlock();
- }
- } else {
- rcu_read_unlock();
+ bond->send_peer_notif--;
}
if (commit) {
- /* Race avoidance with bond_close cancel of workqueue */
- if (!rtnl_trylock()) {
- delay = 1;
- should_notify_peers = false;
- goto re_arm;
- }
-
bond_for_each_slave(bond, slave, iter) {
bond_commit_link_state(slave, BOND_SLAVE_NOTIFY_LATER);
}
bond_miimon_commit(bond);
-
- rtnl_unlock(); /* might sleep, hold no other locks */
}
+ rtnl_unlock(); /* might sleep, hold no other locks */
+
re_arm:
if (bond->params.miimon)
queue_delayed_work(bond->wq, &bond->mii_work, delay);
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
2025-06-16 15:54 ` Stanislav Fomichev
@ 2025-06-16 16:07 ` syzbot
0 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2025-06-16 16:07 UTC (permalink / raw)
To: davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
stfomichev, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: suspicious RCU usage in bond_mii_monitor
=============================
WARNING: suspicious RCU usage
6.16.0-rc2-syzkaller-ge04c78d86a96-dirty #0 Not tainted
-----------------------------
drivers/net/bonding/bond_main.c:2736 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
3 locks held by kworker/u32:0/12:
#0: ffff888044cc7948 ((wq_completion)bond0#2){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc900000f7d10 ((work_completion)(&(&bond->mii_work)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
#2: ffffffff9034d128 (rtnl_mutex){+.+.}-{4:4}, at: bond_mii_monitor+0x122/0x2a20 drivers/net/bonding/bond_main.c:2966
stack backtrace:
CPU: 2 UID: 0 PID: 12 Comm: kworker/u32:0 Not tainted 6.16.0-rc2-syzkaller-ge04c78d86a96-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bond0 bond_mii_monitor
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6871
bond_miimon_inspect drivers/net/bonding/bond_main.c:2736 [inline]
bond_mii_monitor+0xab6/0x2a20 drivers/net/bonding/bond_main.c:2973
process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
kthread+0x3c2/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: now running without any active interface!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex
bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex
bond0: active interface up!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex
bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex
bond0: active interface up!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex
bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex
bond0: active interface up!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: now running without any active interface!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: now running without any active interface!
bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex
bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex
bond0: active interface up!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: now running without any active interface!
bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex
bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex
bond0: active interface up!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: now running without any active interface!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex
bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex
bond0: active interface up!
bond0: (slave bond_slave_0): interface is now down
bond0: (slave bond_slave_1): interface is now down
Tested on:
commit: e04c78d8 Linux 6.16-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1321e90c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4130f4d8a06c3e71
dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1423490c580000
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [syzbot] [net?] WARNING in __linkwatch_sync_dev (2)
2025-06-12 2:21 [syzbot] [net?] WARNING in __linkwatch_sync_dev (2) syzbot
2025-06-13 1:09 ` Stanislav Fomichev
2025-06-13 20:30 ` syzbot
@ 2025-08-02 15:01 ` syzbot
2 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2025-08-02 15:01 UTC (permalink / raw)
To: andrew, cratiu, davem, edumazet, horms, jv, kuba, kuni1840,
kuniyu, kuniyu, linux-kernel, liuhangbin, netdev, pabeni, sdf,
stfomichev, syzkaller-bugs
syzbot has bisected this issue to:
commit 04efcee6ef8d0f01eef495db047e7216d6e6e38f
Author: Stanislav Fomichev <sdf@fomichev.me>
Date: Fri Apr 4 16:11:22 2025 +0000
net: hold instance lock during NETDEV_CHANGE
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13eb22a2580000
start commit: afd8c2c9e2e2 Merge branch 'ipv6-f6i-fib6_siblings-and-rt-f..
git tree: net
final oops: https://syzkaller.appspot.com/x/report.txt?x=101b22a2580000
console output: https://syzkaller.appspot.com/x/log.txt?x=17eb22a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4bcc0a11b3192be
dashboard link: https://syzkaller.appspot.com/bug?extid=b8c48ea38ca27d150063
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11fa74a2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117731bc580000
Reported-by: syzbot+b8c48ea38ca27d150063@syzkaller.appspotmail.com
Fixes: 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-08-02 15:01 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-12 2:21 [syzbot] [net?] WARNING in __linkwatch_sync_dev (2) syzbot
2025-06-13 1:09 ` Stanislav Fomichev
2025-06-13 23:56 ` Jakub Kicinski
2025-06-13 20:30 ` syzbot
2025-06-16 15:54 ` Stanislav Fomichev
2025-06-16 16:07 ` syzbot
2025-08-02 15:01 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).