tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net/rds: Fix circular locking dependency in rds_tcp_tune

syzbot reported a circular locking dependency in rds_tcp_tune() where
sk_net_refcnt_upgrade() is called while holding the socket lock:

======================================================
WARNING: possible circular locking dependency detected
======================================================
kworker/u10:8/15040 is trying to acquire lock:
ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},
at: __kmalloc_cache_noprof+0x4b/0x6f0

but task is already holding lock:
ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},
at: rds_tcp_tune+0xd7/0x930

The issue occurs because sk_net_refcnt_upgrade() performs memory
allocation (via get_net_track() -> ref_tracker_alloc()) while the
socket lock is held, creating a circular dependency with fs_reclaim.

Fix this by moving sk_net_refcnt_upgrade() outside the socket lock
critical section. This is safe because the fields modified by the
sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not
accessed by any concurrent code path at this point.

v2:
- Corrected fixes tag
- check patch line wrap nits
- ai commentary nits

Reported-by: syzbot+2e2cf5331207053b8106@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2e2cf5331207053b8106
Fixes: 3a58f13a881e ("net: rds: acquire refcount on TCP sockets")
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260227202336.167757-1-achender@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

Allison Henderson and committed by
Paolo Abeni 6a877ece 710f5c76

+10 -4
+10 -4
net/rds/tcp.c
··· 490 490 struct rds_tcp_net *rtn; 491 491 492 492 tcp_sock_set_nodelay(sock->sk); 493 - lock_sock(sk); 494 493 /* TCP timer functions might access net namespace even after 495 494 * a process which created this net namespace terminated. 496 495 */ 497 496 if (!sk->sk_net_refcnt) { 498 - if (!maybe_get_net(net)) { 499 - release_sock(sk); 497 + if (!maybe_get_net(net)) 500 498 return false; 501 - } 499 + /* 500 + * sk_net_refcnt_upgrade() must be called before lock_sock() 501 + * because it does a GFP_KERNEL allocation, which can trigger 502 + * fs_reclaim and create a circular lock dependency with the 503 + * socket lock. The fields it modifies (sk_net_refcnt, 504 + * ns_tracker) are not accessed by any concurrent code path 505 + * at this point. 506 + */ 502 507 sk_net_refcnt_upgrade(sk); 503 508 put_net(net); 504 509 } 510 + lock_sock(sk); 505 511 rtn = net_generic(net, rds_tcp_netid); 506 512 if (rtn->sndbuf_size > 0) { 507 513 sk->sk_sndbuf = rtn->sndbuf_size;