[lkml]   [2020]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRE: possible deadlock in cma_netdev_callback
-----"Jason Gunthorpe" <> wrote: -----

>To: "syzbot" <>
>From: "Jason Gunthorpe" <>
>Date: 02/26/2020 09:42PM
>,, "Bernard
>Metzler" <>
>Subject: [EXTERNAL] Re: possible deadlock in cma_netdev_callback
>On Tue, Feb 25, 2020 at 09:39:10PM -0800, syzbot wrote:
>> Hello,
>> syzbot found the following crash on:
>> HEAD commit: 6132c1d9 net: core: devlink.c: Hold devlink->lock
>from the..
>> git tree: net
>> console output:
>> kernel config:
>> dashboard link:
>> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>> syz repro:
>> C reproducer:
>> IMPORTANT: if you fix the bug, please add the following tag to the
>> Reported-by:
>> iwpm_register_pid: Unable to send a nlmsg (client = 2)
>> infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98
>> netlink: 'syz-executor639': attribute type 1 has an invalid length.
>> 8021q: adding VLAN 0 to HW filter on device bond1
>> bond1: (slave gretap1): making interface the new active one
>> ======================================================
>> WARNING: possible circular locking dependency detected
>> 5.6.0-rc2-syzkaller #0 Not tainted
>> syz-executor639/9689 is trying to acquire lock:
>> ffffffff8a5d2a60 (lock#3){+.+.}, at: cma_netdev_callback+0xc6/0x380
>> but task is already holding lock:
>> ffffffff8a74da00 (rtnl_mutex){+.+.}, at: rtnl_lock
>net/core/rtnetlink.c:72 [inline]
>> ffffffff8a74da00 (rtnl_mutex){+.+.}, at:
>rtnetlink_rcv_msg+0x405/0xaf0 net/core/rtnetlink.c:5433
>Bernard, this is a siw bug too, it is not allowed to get RTNL in
>siw_create_listen() (though this is probably for silly reasons and
>could be fixed)
>It is not easy to get this into the lockdep, I'll send a different
>patch too
Hi Jason,

Thanks for letting me know! Hmm, we cannot use RCU locks since
we potentially sleep. One solution would be to create a list
of matching interfaces while under lock, unlock and use that
list for calling siw_listen_address() (which may sleep),

Many thanks,

 \ /
  Last update: 2020-02-27 11:11    [W:0.063 / U:0.268 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site