On Tue, Oct 1, 2024 at 6:54 AM Daniel Yang <danielyangkang@xxxxxxxxx> wrote: > > Ok I see the issue. Yes it does seem to be a false positive. Then do we already have lockdep classes and subclasses set up for lock_sock() to prevent other false positives like this one? If not, should I add one then to resolve this? > Please do not top post on linux mailing lists About your question : https://lore.kernel.org/netdev/CANn89iKcWmufo83xy-SwSrXYt6UpL2Pb+5pWuzyYjMva5F8bBQ@xxxxxxxxxxxxxx/ > On Mon, Sep 30, 2024 at 8:04 PM Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> wrote: >> >> From: Daniel Yang <danielyangkang@xxxxxxxxx> >> Date: Mon, 30 Sep 2024 18:55:54 -0700 >> > Fixes deadlock described in this bug: >> > https://syzkaller.appspot.com/bug?extid=e953a8f3071f5c0a28fd. >> > Specific crash report here: >> > https://syzkaller.appspot.com/text?tag=CrashReport&x=14670e07980000. >> > >> > DESCRIPTION OF ISSUE >> > Deadlock: sk_lock-AF_INET --> &smc->clcsock_release_lock --> rtnl_mutex >> > >> > rtnl_mutex->sk_lock-AF_INET >> > rtnetlink_rcv_msg() acquires rtnl_lock() and calls rtnl_newlink(), which >> > eventually calls gtp_newlink() which calls lock_sock() to attempt to >> > acquire sk_lock. >> >> Is the deadlock real ? >> >> From the lockdep splat, the gtp's sk_protocol is verified to be >> IPPROTO_UDP before holding lock_sock(), so it seems just a labeling >> issue. >> https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/tree/drivers/net/gtp.c?id=9410645520e9b820069761f3450ef6661418e279#n1674 >> >> >> > >> > sk_lock-AF_INET->&smc->clcsock_release_lock >> > smc_sendmsg() calls lock_sock() to acquire sk_lock, then calls >> > smc_switch_to_fallback() which attempts to acquire mutex_lock(&smc->...). >> > >> > &smc->clcsock_release_lock->rtnl_mutex >> > smc_setsockopt() calls mutex_lock(&smc->...). smc->...->setsockopt() is >> > called, which calls nf_setsockopt() which attempts to acquire >> > rtnl_lock() in some nested call in start_sync_thread() in ip_vs_sync.c. >> > >> > FIX: >> > In smc_switch_to_fallback(), separate the logic into inline function >> > __smc_switch_to_fallback(). In smc_sendmsg(), lock ordering can be >> > modified and the functionality of smc_switch_to_fallback() is >> > encapsulated in the __smc_switch_to_fallback() function.
