From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83CFE481233 for ; Tue, 25 Aug 2026 15:22:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787671322; cv=none; b=JGoUFtZEWfve/o5K8nMGu1iCbqZH25osA+LWqopoELR7SW1fWHH/aeiaueVFQFrsQTq4KwEz8jIy5aYpRpLex8JkFvJ3SZWBtJv3G2nHphs9emKbpSBLGnLkrm8NlY4kT0F1us+zJnd5GX6hlLF+X2cSEofmYZt0eCAmj8FaObg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787671322; c=relaxed/simple; bh=4PoPYG2K42mgciAjX9Rt4iKz0r6GaC4A0xnXs67guIg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YYu79qQEMktQH9B+EKqZn7wVYXMpEK+2o8GwVpupyT6XBAn84X2bs8iKZHZB3ThD0heErdIXxLkUqDC9VD6t37TILHohQRAzx44asOj+2HUYm3bFJFpjDRVP1ilGWsph8v19yPHhMUJnk78pkVno5aF9NBqNDEBgb6YWnOr6w0Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iidRA+cs; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iidRA+cs" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2d6b5aa7535so21913845ad.2 for ; Tue, 25 Aug 2026 08:22:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787671320; x=1788276120; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=vc0aZw4w9FJVpAPDqzy/8czgK3vByXWj1yC+3VTKlDs=; b=iidRA+csNi8GFxFapmvdN+z5e9hQYaQW+bfl52Yk1LnnDz1hI+4fdgOr0CJzA6TQ3p 2wbrkgD5sGbrU9FLArGmRLNXS2vzJi0j6+lj6SAuUNZPh4JeE8Zmk75TeT0GpMiuKdFk Ne1oOSHUJic46GMkJdDd9d91jdBOrG1qMA+ZxAmDYdgqFML7uxgvqQI9bxI8KFXanKSV hPeiDNnZpbf5DGiN9pkjfzt6gC1vZ381alng6ZdERktLijR5R+MQh95ACyP4tOsnbq+f mYm52xvMSFMor6veGoyF4F4ZJSHxjOtWMkgK+LoPppfQAvn7rbARRZiGMZ2f/91dOj2t t1Kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787671320; x=1788276120; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vc0aZw4w9FJVpAPDqzy/8czgK3vByXWj1yC+3VTKlDs=; b=hYEKIJhrL0mpwOeYWYiPbbyE3uJ8lQMjl7lhM7u/3Ju3bXzTVo94xLwq62kUN9PJ5L +QL/vICLG7dtIF+FNHK8Lz1BC7R0uYL6jL0FE7dxaMLvOmMyHcqm7inTQFuwjtpZ3KmI OIaKYlU5zycpdxw85qF3HjTh/yWFCmu94xVvUCma1u3tnOzIoDXOB4jTV/5Bla3sfO6Y QFm2ga0tN5+eX2VUL8lpHDHmRSRbnW8mkw6cA32sNcpUXjIAYWW1IHRgDFL+8HLuS07v +e+mkCqYBorPLjbjCvuCCgf8EhD632LAoHw0gGpGOg8Ltok4WeG756bPk07ed+t6VzN2 C9Xg== X-Gm-Message-State: AFuF++kFkWCPa/ZqwIlguHU48p2/bKeXU0Dj8kYyOEUbZ16LjtPIRrhY tPFuMn64hltsO2R6j3vXfTrTs6ZU4zpdkoJ+WDCo3uBMyOl7TbIMoA1b X-Gm-Gg: AR+sD13lnp23pLHedrIUCFo6l//4IEZYu+K0sJAlzHYCs2haHb3NkO0jmjQix/bicCt kMQ9aBEVJgxxwRoPB0jc7fqhMU/CAOZpEjzszam3PrI0BWAI6ZNSac0fXNjfM3SMZJZ3x/H4hbz 52IJyZ112DBPsRO/7yXik1hzZ+Iuj53hPGX1cAVI51I0+f65o31oYwYrQcSgiYzp38pwR185JQ+ wv6jBYGCdC+AuyyfcMW9Nh0HR30BBsOf8YTxf3yOqgIs8EvZM3k414/e4z4UEnlEcNqePtZVbQy bDLQzXemC+EL2YZ+8rXuTLNn1q5Y1AwiEnQo2RQkbwus1FARmJWnxFLf+1X9BdY89mSxaheAKeH 83Ho5Yd+ssaJ8ZNwxF+ouUeMyikl3TKakkFDkNJdRgcKJ0p8btSemn4/sE76QcUZw0A52yV4OXk Q5/A/2YmGuc7kf9hO5sLlyJ60av29sCa/MUinCzVopuZXpnoDsbXlKZKtsEuOlrSWaPNzizVfz9 jOTTlpnwYz0xz5b8UxbKEXF4lN+ X-Received: by 2002:a17:902:ec87:b0:2cf:8131:75e8 with SMTP id d9443c01a7336-2d64b11893amr553802935ad.13.1787671320277; Tue, 25 Aug 2026 08:22:00 -0700 (PDT) Received: from localhost.localdomain ([103.210.91.42]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f9236166sm37282967eec.28.2026.08.25.08.21.55 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 25 Aug 2026 08:21:59 -0700 (PDT) From: Khawar Ahemad To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, magnus.karlsson@intel.com, maciej.fijalkowski@intel.com, sdf@fomichev.me, ast@kernel.org, daniel@iogearbox.net, kuba@kernel.org, pabeni@redhat.com, syzbot+aa48b5fe7bfda62d1682@syzkaller.appspotmail.com, ahemadkhawar123@gmail.com Subject: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind Date: Tue, 25 Aug 2026 20:51:52 +0530 Message-ID: <20260825152152.86092-1-ahemadkhawar123@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit syzbot reported a circular locking dependency involving &net->xdp.lock, &xs->mutex, and netdev_lock_ops(): -> #3 (&net->xdp.lock): xsk_notifier unregister_netdevice_many_notify rtnl_dellink -> #2 (&port->pnodes_lock / netdev_lock): ipvlan_device_event / bond / netdev_change_features -> #1 (netdev_lock_ops): xsk_bind (holds xs->mutex, takes netdev_lock_ops(dev)) -> #0 (&xs->mutex): xsk_diag_dump (holds net->xdp.lock, takes xs->mutex) In xsk_bind(), xs->mutex was acquired before dev_get_by_index() and netdev_lock_ops(dev). However, in netdev notifier callbacks like xsk_notifier(), netdev_lock_ops(dev) is held by the netdev core while taking net->xdp.lock and then xs->mutex, creating an ABBA lock inversion between xs->mutex and netdev_lock_ops(dev). Fix this by looking up the target net_device and acquiring netdev_lock_ops(dev) before acquiring xs->mutex in xsk_bind(). This aligns xsk_bind() with the global lock hierarchy: rtnl_lock -> netdev_lock_ops(dev) -> net->xdp.lock -> xs->mutex. Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind") Reported-by: syzbot+aa48b5fe7bfda62d1682@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=aa48b5fe7bfda62d1682 Signed-off-by: Khawar Ahemad --- net/xdp/xsk.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 7855ee09c4..d2fbbeb7b6 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -1612,19 +1612,18 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr return -EINVAL; rtnl_lock(); - mutex_lock(&xs->mutex); - if (xs->state != XSK_READY) { - err = -EBUSY; - goto out_release; - } - dev = dev_get_by_index(sock_net(sk), sxdp->sxdp_ifindex); if (!dev) { err = -ENODEV; - goto out_release; + goto out_rtnl_unlock; } netdev_lock_ops(dev); + mutex_lock(&xs->mutex); + if (xs->state != XSK_READY) { + err = -EBUSY; + goto out_unlock; + } if (!xs->rx && !xs->tx) { err = -EINVAL; @@ -1771,9 +1770,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr smp_wmb(); WRITE_ONCE(xs->state, XSK_BOUND); } - netdev_unlock_ops(dev); -out_release: mutex_unlock(&xs->mutex); + netdev_unlock_ops(dev); +out_rtnl_unlock: rtnl_unlock(); return err; } -- 2.54.0 (Apple Git-157)