summaryrefslogtreecommitdiffstats
path: root/net/xdp/xsk.c
diff options
context:
space:
mode:
authorIlya Maximets <i.maximets@samsung.com>2019-07-08 14:03:44 +0300
committerDaniel Borkmann <daniel@iogearbox.net>2019-07-12 15:02:21 +0200
commit5464c3a0e9a037b63d5229cdea08dddc01a98aac (patch)
treeb7d54d9aef6b6e95b7db08ad745aa5345b4a856f /net/xdp/xsk.c
parent675716400da6f15b9d3db04ef74ee74ca9a00af3 (diff)
downloadlinux-5464c3a0e9a037b63d5229cdea08dddc01a98aac.tar.bz2
xdp: fix potential deadlock on socket mutex
There are 2 call chains: a) xsk_bind --> xdp_umem_assign_dev b) unregister_netdevice_queue --> xsk_notifier with the following locking order: a) xs->mutex --> rtnl_lock b) rtnl_lock --> xdp.lock --> xs->mutex Different order of taking 'xs->mutex' and 'rtnl_lock' could produce a deadlock here. Fix that by moving the 'rtnl_lock' before 'xs->lock' in the bind call chain (a). Reported-by: syzbot+bf64ec93de836d7f4c2c@syzkaller.appspotmail.com Fixes: 455302d1c9ae ("xdp: fix hang while unregistering device bound to xdp socket") Signed-off-by: Ilya Maximets <i.maximets@samsung.com> Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'net/xdp/xsk.c')
-rw-r--r--net/xdp/xsk.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index b994c32a664a..59b57d708697 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -430,6 +430,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
if (flags & ~(XDP_SHARED_UMEM | XDP_COPY | XDP_ZEROCOPY))
return -EINVAL;
+ rtnl_lock();
mutex_lock(&xs->mutex);
if (xs->state != XSK_READY) {
err = -EBUSY;
@@ -515,6 +516,7 @@ out_unlock:
xs->state = XSK_BOUND;
out_release:
mutex_unlock(&xs->mutex);
+ rtnl_unlock();
return err;
}