Re: [PATCH net] netlink: Do not call the unbind callback with the table locked

[Simon Horman <horms@kernel.org>]

On Mon, Nov 02, 2026 at 12:09:29PM +0000, Anil Kaushik wrote:
> When netlink_bind() fails to insert the socket, it calls
> netlink_undo_bind() with the table locked. genl_unbind() then takes
> cb_lock, while genl_unregister_family() and genl_register_family() take
> cb_lock for writing and then wait in netlink_table_grab() for the table
> users to go away:
> 
>   netlink_bind()                 genl_unregister_family()
>     netlink_lock_table()           down_write(&cb_lock)
>     netlink_insert() fails
>     netlink_undo_bind()            netlink_table_grab()
>       genl_unbind()                  waits for nl_table_users == 0
>         down_read(&cb_lock)
> 
> An unprivileged user can get here by binding to a port ID that is in
> use, with nl_groups set. Lockdep does not see it, as nl_table_users is a
> plain counter.
> 
> Unlock the table first, as the comment in netlink_release() asks for.
> 
> Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261101101347.3910654-1-anilkaushikwireless@gmail.com
> Fixes: 3de21a8990d3 ("genetlink: Add per family bind/unbind callbacks")
> Signed-off-by: Anil Kaushik <anilkaushikwireless@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>