Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Hillf Danton <> | Subject | Re: [syzbot] [bpf?] possible deadlock in trie_delete_elem | Date | Wed, 20 Mar 2024 18:32:24 +0800 |
| |
On Wed, 20 Mar 2024 01:42:21 -0700 > syzbot found the following issue on: > > HEAD commit: 32fa4366cc4d net: phy: fix phy_read_poll_timeout argument .. > git tree: net > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1676fc6e180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git 32fa4366cc4d
--- x/kernel/bpf/lpm_trie.c +++ y/kernel/bpf/lpm_trie.c @@ -321,7 +321,7 @@ static long trie_update_elem(struct bpf_ if (key->prefixlen > trie->max_prefixlen) return -EINVAL; - spin_lock_irqsave(&trie->lock, irq_flags); + spin_lock_irqsave_nested(&trie->lock, irq_flags, 1); /* Allocate and fill a new node */ @@ -448,7 +448,7 @@ static long trie_delete_elem(struct bpf_ if (key->prefixlen > trie->max_prefixlen) return -EINVAL; - spin_lock_irqsave(&trie->lock, irq_flags); + spin_lock_irqsave_nested(&trie->lock, irq_flags, 2); /* Walk the tree looking for an exact key/length match and keeping * track of the path we traverse. We will need to know the node --
| ![\](/images/icornerr.gif) |