Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [net?] [bpf?] possible deadlock in sock_hash_delete_elem (2) | Date | Sat, 27 Apr 2024 16:15:36 +0800 |
| |
On Fri, 26 Apr 2024 23:08:19 -0700 > syzbot has found a reproducer for the following issue on: > > HEAD commit: b2ff42c6d3ab Merge tag 'for-netdev' of https://git.kernel... > git tree: bpf > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13c06aa0980000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git b2ff42c6d3ab
--- x/net/core/sock_map.c +++ y/net/core/sock_map.c @@ -928,6 +928,7 @@ static void sock_hash_delete_from_link(s spin_unlock_bh(&bucket->lock); } +static DEFINE_PER_CPU(int, subclass); static long sock_hash_delete_elem(struct bpf_map *map, void *key) { struct bpf_shtab *htab = container_of(map, struct bpf_shtab, map); @@ -935,6 +936,7 @@ static long sock_hash_delete_elem(struct struct bpf_shtab_bucket *bucket; struct bpf_shtab_elem *elem; int ret = -ENOENT; + int *class; if (irqs_disabled()) return -EOPNOTSUPP; /* locks here are hardirq-unsafe */ @@ -942,7 +944,10 @@ static long sock_hash_delete_elem(struct hash = sock_hash_bucket_hash(key, key_size); bucket = sock_hash_select_bucket(htab, hash); - spin_lock_bh(&bucket->lock); + local_bh_disable(); + class = this_cpu_ptr(&subclass); + *class += 1; + spin_lock_nested(&bucket->lock, *class); elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); if (elem) { hlist_del_rcu(&elem->node); @@ -950,6 +955,7 @@ static long sock_hash_delete_elem(struct sock_hash_free_elem(htab, elem); ret = 0; } + *class -= 1; spin_unlock_bh(&bucket->lock); return ret; } --
| |