Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

hv_netvsc: fix potential deadlock in netvsc_vf_setxdp()

The MANA driver's probe registers netdevice via the following call chain:

mana_probe()
register_netdev()
register_netdevice()

register_netdevice() calls notifier callback for netvsc driver,
holding the netdev mutex via netdev_lock_ops().

Further this netvsc notifier callback end up attempting to acquire the
same lock again in dev_xdp_propagate() leading to deadlock.

netvsc_netdev_event()
netvsc_vf_setxdp()
dev_xdp_propagate()

This deadlock was not observed so far because net_shaper_ops was never set,
and thus the lock was effectively a no-op in this case. Fix this by using
netif_xdp_propagate() instead of dev_xdp_propagate() to avoid recursive
locking in this path.

And, since no deadlock is observed on the other path which is via
netvsc_probe, add the lock exclusivly for that path.

Also, clean up the unregistration path by removing the unnecessary call to
netvsc_vf_setxdp(), since unregister_netdevice_many_notify() already
performs this cleanup via dev_xdp_uninstall().

Fixes: 97246d6d21c2 ("net: hold netdev instance lock during ndo_bpf")
Cc: stable@vger.kernel.org
Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
Tested-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: Subbaraya Sundeep <sbhatta@marvell.com>
Link: https://patch.msgid.link/1748513910-23963-1-git-send-email-ssengar@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Saurabh Sengar and committed by
Jakub Kicinski
3ec52330 c1f4cb8a

+4 -3
+1 -1
drivers/net/hyperv/netvsc_bpf.c
··· 183 183 xdp.command = XDP_SETUP_PROG; 184 184 xdp.prog = prog; 185 185 186 - ret = dev_xdp_propagate(vf_netdev, &xdp); 186 + ret = netif_xdp_propagate(vf_netdev, &xdp); 187 187 188 188 if (ret && prog) 189 189 bpf_prog_put(prog);
+2 -2
drivers/net/hyperv/netvsc_drv.c
··· 2462 2462 2463 2463 netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name); 2464 2464 2465 - netvsc_vf_setxdp(vf_netdev, NULL); 2466 - 2467 2465 reinit_completion(&net_device_ctx->vf_add); 2468 2466 netdev_rx_handler_unregister(vf_netdev); 2469 2467 netdev_upper_dev_unlink(vf_netdev, ndev); ··· 2629 2631 continue; 2630 2632 2631 2633 netvsc_prepare_bonding(vf_netdev); 2634 + netdev_lock_ops(vf_netdev); 2632 2635 netvsc_register_vf(vf_netdev, VF_REG_IN_PROBE); 2636 + netdev_unlock_ops(vf_netdev); 2633 2637 __netvsc_vf_setup(net, vf_netdev); 2634 2638 break; 2635 2639 }
+1
net/core/dev.c
··· 9968 9968 9969 9969 return dev->netdev_ops->ndo_bpf(dev, bpf); 9970 9970 } 9971 + EXPORT_SYMBOL_GPL(netif_xdp_propagate); 9971 9972 9972 9973 u32 dev_xdp_prog_id(struct net_device *dev, enum bpf_xdp_mode mode) 9973 9974 {