Re: [PATCH bpf-next] xsk: Fix circular locking dependency in xsk_bind

[Daniel Borkmann]

On 8/25/26 5:21 PM, Khawar Ahemad wrote:
> syzbot reported a circular locking dependency involving &net->xdp.lock,
> &xs->mutex, and netdev_lock_ops():
>
> -> #3 (&net->xdp.lock):
>         xsk_notifier
>         unregister_netdevice_many_notify
>         rtnl_dellink
>
> -> #2 (&port->pnodes_lock / netdev_lock):
>         ipvlan_device_event / bond / netdev_change_features
>
> -> #1 (netdev_lock_ops):
>         xsk_bind (holds xs->mutex, takes netdev_lock_ops(dev))
>
> -> #0 (&xs->mutex):
>         xsk_diag_dump (holds net->xdp.lock, takes xs->mutex)
>
> In xsk_bind(), xs->mutex was acquired before dev_get_by_index() and
> netdev_lock_ops(dev). However, in netdev notifier callbacks like
> xsk_notifier(), netdev_lock_ops(dev) is held by the netdev core while
> taking net->xdp.lock and then xs->mutex, creating an ABBA lock
> inversion between xs->mutex and netdev_lock_ops(dev).
>
> Fix this by looking up the target net_device and acquiring
> netdev_lock_ops(dev) before acquiring xs->mutex in xsk_bind(). This
> aligns xsk_bind() with the global lock hierarchy:
> rtnl_lock -> netdev_lock_ops(dev) -> net->xdp.lock -> xs->mutex.
>
> Fixes: 978939c08db1 ("xsk: use netdev_lock_ops in xsk_bind")
> Reported-by: syzbot+aa48b5fe7bfda62d1682@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=aa48b5fe7bfda62d1682
> Signed-off-by: Khawar Ahemad <ahemadkhawar123@xxxxxxxxx>

This creates a deadlock with the change in the following:

 - xsk_bind() takes dev->lock -> xs->mutex
 - xsk_notifier() -> xp_clear_dev() takes xs->mutex -> dev->lock

... also Fixes tag does not exist.