Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp2631371pxj; Mon, 14 Jun 2021 03:32:23 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxEVzAm9goYYVob3kUgIQl3JVUOj58QWRyY5W3e3rLp3yzNxPyCbBKpNaYpad7j9TaUe6DA X-Received: by 2002:a17:907:1c25:: with SMTP id nc37mr14928611ejc.300.1623666742966; Mon, 14 Jun 2021 03:32:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623666742; cv=none; d=google.com; s=arc-20160816; b=Ty4e9X7St1TGsBHV/suzIal5ih0pKEAyXouSgTMiEIcf2hA8SOxtgAMFXXmvrWCYmp S0CBHzwOC8DybNFtCy2bKR78o06x2q2lEFu3+EMduWirVV1IZUd5NJxtjmJo86Mynsuq 12Dn5CJJ2ZlNUYo6kPu1oDBIfSqm2bYOBWjTRrZlekLll2hIjDGah4e9qSFO3VhqOM3z oapYtm72ZqT4X6RchivrBTrR+q8xuwwlv5o+yAh+xI80VxLekg2Y/PDymB6Vgr+CpoGm dT6pc5duIKyiey7auvDvMv6vTAOuS0gej+4cHFZInBNYUY5lJpxi8SHCp7NcjIa4CPDk zqKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bg9IcJt84jfCu4tkTIAtVo5uwkqHUI0BGI7M4tj4BTI=; b=qQzBKRHuPZMPVsk/9gVQi7/xTFCi8jbB+6HKFT+OMmVZou8q1jLW+4qAcCJNKmsTus 0uV8KSM+x9S4lugmxN8kWSYmZ2YH+pospGZEYjIkaMvi6tx2+oNvtTqwYeoYusLByAJu SfmYDYjYvGWSGJoT+qwWwYODOYYZKjBRjsysJb8yKty7FG9T1AXOppMd8320nAMTzIEF BTszLNH1BXrj2z8cN+BFtjivXNEUY64A78YH2zQjQfmW9MJ9jaL44NG/jnb7KwKaos9R Xs+EAG61V96XR8E+t+BdEu/L+Q9doKD8QrtAoyBG02vcrXnAREKZ9XO9lC0N6KlDXP2M xv5A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=NqGcvUFW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y13si11011085edo.465.2021.06.14.03.32.00; Mon, 14 Jun 2021 03:32:22 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=NqGcvUFW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233004AbhFNKb7 (ORCPT + 99 others); Mon, 14 Jun 2021 06:31:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:37818 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232896AbhFNKbT (ORCPT ); Mon, 14 Jun 2021 06:31:19 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 31BDE61004; Mon, 14 Jun 2021 10:29:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623666540; bh=MAMQ78x0u265sFMbXfgRIrLXwkxSn0ebRdVeJrH3wVw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NqGcvUFW5KVCcB45aveWluFf9Qw4RIwyEzSy/FftR/Atuy2IBgnDott9BR20SmTH5 hWNW04NvyjTOdLPWOJbaR4Z9NlWbHSF5JB9p/4h2NGaB9CIr4NgeEu1cmZxewOyuF0 vPZuJskGuXkizI65akf4pAETKIUgP/iJRjAX4nxg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com, Johannes Berg , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 06/34] netlink: disable IRQs for netlink_lock_table() Date: Mon, 14 Jun 2021 12:26:57 +0200 Message-Id: <20210614102641.800209963@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210614102641.582612289@linuxfoundation.org> References: <20210614102641.582612289@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johannes Berg [ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ] Syzbot reports that in mac80211 we have a potential deadlock between our "local->stop_queue_reasons_lock" (spinlock) and netlink's nl_table_lock (rwlock). This is because there's at least one situation in which we might try to send a netlink message with this spinlock held while it is also possible to take the spinlock from a hardirq context, resulting in the following deadlock scenario reported by lockdep: CPU0 CPU1 ---- ---- lock(nl_table_lock); local_irq_disable(); lock(&local->queue_stop_reason_lock); lock(nl_table_lock); lock(&local->queue_stop_reason_lock); This seems valid, we can take the queue_stop_reason_lock in any kind of context ("CPU0"), and call ieee80211_report_ack_skb() with the spinlock held and IRQs disabled ("CPU1") in some code path (ieee80211_do_stop() via ieee80211_free_txskb()). Short of disallowing netlink use in scenarios like these (which would be rather complex in mac80211's case due to the deep callchain), it seems the only fix for this is to disable IRQs while nl_table_lock is held to avoid hitting this scenario, this disallows the "CPU0" portion of the reported deadlock. Note that the writer side (netlink_table_grab()) already disables IRQs for this lock. Unfortunately though, this seems like a huge hammer, and maybe the whole netlink table locking should be reworked. Reported-by: syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com Signed-off-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/netlink/af_netlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index cc37a219e11e..c20c41801845 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -436,11 +436,13 @@ void netlink_table_ungrab(void) static inline void netlink_lock_table(void) { + unsigned long flags; + /* read_lock() synchronizes us to netlink_table_grab */ - read_lock(&nl_table_lock); + read_lock_irqsave(&nl_table_lock, flags); atomic_inc(&nl_table_users); - read_unlock(&nl_table_lock); + read_unlock_irqrestore(&nl_table_lock, flags); } static inline void -- 2.30.2