Files
linux/include/linux
Kuniyuki Iwashima ed3ba9b6e2 net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to
br_ioctl_call(), which causes unnecessary RTNL dance and the splat
below [0] under RTNL pressure.

Let's say Thread A is trying to detach a device from a bridge and
Thread B is trying to remove the bridge.

In dev_ioctl(), Thread A bumps the bridge device's refcnt by
netdev_hold() and releases RTNL because the following br_ioctl_call()
also re-acquires RTNL.

In the race window, Thread B could acquire RTNL and try to remove
the bridge device.  Then, rtnl_unlock() by Thread B will release RTNL
and wait for netdev_put() by Thread A.

Thread A, however, must hold RTNL after the unlock in dev_ifsioc(),
which may take long under RTNL pressure, resulting in the splat by
Thread B.

  Thread A (SIOCBRDELIF)           Thread B (SIOCBRDELBR)
  ----------------------           ----------------------
  sock_ioctl                       sock_ioctl
  `- sock_do_ioctl                 `- br_ioctl_call
     `- dev_ioctl                     `- br_ioctl_stub
        |- rtnl_lock                     |
        |- dev_ifsioc                    '
        '  |- dev = __dev_get_by_name(...)
           |- netdev_hold(dev, ...)      .
       /   |- rtnl_unlock  ------.       |
       |   |- br_ioctl_call       `--->  |- rtnl_lock
  Race |   |  `- br_ioctl_stub           |- br_del_bridge
  Window   |     |                       |  |- dev = __dev_get_by_name(...)
       |   |     |  May take long        |  `- br_dev_delete(dev, ...)
       |   |     |  under RTNL pressure  |     `- unregister_netdevice_queue(dev, ...)
       |   |     |               |       `- rtnl_unlock
       \   |     |- rtnl_lock  <-'          `- netdev_run_todo
           |     |- ...                        `- netdev_run_todo
           |     `- rtnl_unlock                   |- __rtnl_unlock
           |                                      |- netdev_wait_allrefs_any
           |- netdev_put(dev, ...)  <----------------'
                                                Wait refcnt decrement
                                                and log splat below

To avoid blocking SIOCBRDELBR unnecessarily, let's not call
dev_ioctl() for SIOCBRADDIF and SIOCBRDELIF.

In the dev_ioctl() path, we do the following:

  1. Copy struct ifreq by get_user_ifreq in sock_do_ioctl()
  2. Check CAP_NET_ADMIN in dev_ioctl()
  3. Call dev_load() in dev_ioctl()
  4. Fetch the master dev from ifr.ifr_name in dev_ifsioc()

3. can be done by request_module() in br_ioctl_call(), so we move
1., 2., and 4. to br_ioctl_stub().

Note that 2. is also checked later in add_del_if(), but it's better
performed before RTNL.

SIOCBRADDIF and SIOCBRDELIF have been processed in dev_ioctl() since
the pre-git era, and there seems to be no specific reason to process
them there.

[0]:
unregister_netdevice: waiting for wpan3 to become free. Usage count = 2
ref_tracker: wpan3@ffff8880662d8608 has 1/1 users at
     __netdev_tracker_alloc include/linux/netdevice.h:4282 [inline]
     netdev_hold include/linux/netdevice.h:4311 [inline]
     dev_ifsioc+0xc6a/0x1160 net/core/dev_ioctl.c:624
     dev_ioctl+0x255/0x10c0 net/core/dev_ioctl.c:826
     sock_do_ioctl+0x1ca/0x260 net/socket.c:1213
     sock_ioctl+0x23a/0x6c0 net/socket.c:1318
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:906 [inline]
     __se_sys_ioctl fs/ioctl.c:892 [inline]
     __x64_sys_ioctl+0x1a4/0x210 fs/ioctl.c:892
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 893b195875 ("net: bridge: fix ioctl locking")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Reported-by: yan kang <kangyan91@outlook.com>
Reported-by: yue sun <samsun1006219@gmail.com>
Closes: https://lore.kernel.org/netdev/SY8P300MB0421225D54EB92762AE8F0F2A1D32@SY8P300MB0421.AUSP300.PROD.OUTLOOK.COM/
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250316192851.19781-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-03-21 22:10:06 +01:00
..
2024-10-22 15:54:11 +02:00
2024-10-11 14:34:11 -04:00
2024-10-13 17:16:57 +02:00
2024-10-11 14:37:29 +05:30
2024-10-14 23:27:57 +05:30
2024-11-11 10:45:03 +01:00
2024-10-09 15:42:48 +01:00
2025-01-04 15:27:35 -07:00
2024-11-07 14:38:07 -08:00
2024-10-14 18:33:04 -07:00
2025-01-06 07:36:39 -07:00
2024-09-03 21:15:36 -07:00
2024-06-24 18:29:20 +02:00
2024-12-02 12:01:43 +01:00
2025-01-18 12:33:39 -08:00
2024-11-05 13:32:21 +01:00
2024-10-22 11:16:56 +02:00
2024-12-17 09:16:11 +01:00
2024-10-19 14:16:45 +02:00
2025-01-25 20:22:31 -08:00
2024-11-09 14:55:33 +01:00
2024-11-28 14:49:28 +01:00
2025-01-09 10:06:14 +01:00
2024-08-29 10:39:37 +02:00
2025-01-07 18:06:51 -08:00
2024-11-24 17:05:27 -08:00
2024-12-18 09:39:37 +01:00
2024-07-31 13:49:48 +01:00
2024-10-16 21:56:59 +02:00
2024-06-24 22:24:56 -07:00
2025-01-25 08:22:26 +00:00
2024-09-03 21:15:46 -07:00
2024-09-20 18:28:26 +03:00
2024-09-01 20:26:03 -07:00
2024-11-05 16:56:26 -08:00
2024-07-03 19:30:23 -07:00
2025-01-14 19:45:35 +01:00
2024-12-13 08:49:31 -07:00
2024-12-09 13:48:23 -08:00
2025-02-04 11:27:45 -05:00
2024-10-14 16:33:24 -05:00
2024-08-11 17:04:29 +01:00
2025-01-15 15:07:23 -08:00
2025-02-25 15:07:24 -05:00
2024-09-23 15:03:30 -04:00
2024-06-24 22:25:02 -07:00
2024-11-05 16:56:26 -08:00
2025-01-25 20:22:42 -08:00
2024-08-30 08:22:38 +02:00
2025-02-10 09:22:32 +01:00
2024-11-16 10:09:30 -06:00
2024-10-02 16:23:10 -05:00
2025-01-16 17:22:59 -08:00
2024-12-22 11:03:10 +01:00
2025-01-10 11:59:00 +01:00
2025-01-07 15:16:48 +01:00
2024-11-05 12:55:38 +01:00
2025-03-16 17:40:22 -07:00
2025-01-02 10:37:14 -06:00
2024-12-09 14:44:59 -08:00
2025-01-08 14:50:11 -08:00
2024-09-11 20:44:31 -07:00
2024-12-19 19:51:13 -08:00
2025-01-29 13:32:23 -08:00
2025-01-11 20:39:43 +01:00
2025-01-29 09:04:28 -08:00
2024-11-11 00:26:44 -08:00
2024-07-10 07:59:03 +02:00
2024-11-06 12:59:44 -05:00
2024-10-02 16:53:38 +02:00
2024-08-06 13:42:40 +02:00
2024-11-18 11:56:21 +00:00
2024-12-23 08:17:16 -07:00
2024-06-24 18:16:44 +01:00
2024-12-09 14:44:59 -08:00
2024-11-06 12:59:44 -05:00