af_packet: move notifier's packet_dev_mc out of rcu critical section

Syzkaller reports the following issue:

 BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578
 __mutex_lock+0x106/0xe80 kernel/locking/mutex.c:746
 team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781
 dev_change_rx_flags net/core/dev.c:9145 [inline]
 __dev_set_promiscuity+0x3f8/0x590 net/core/dev.c:9189
 netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9201
 dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:286 packet_dev_mc net/packet/af_packet.c:3698 [inline]
 packet_dev_mclist_delete net/packet/af_packet.c:3722 [inline]
 packet_notifier+0x292/0xa60 net/packet/af_packet.c:4247
 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline]
 call_netdevice_notifiers net/core/dev.c:2228 [inline]
 unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:11972
 rtnl_delete_link net/core/rtnetlink.c:3522 [inline]
 rtnl_dellink+0x488/0x710 net/core/rtnetlink.c:3564
 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6955
 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534

Calling `PACKET_ADD_MEMBERSHIP` on an ops-locked device can trigger
the `NETDEV_UNREGISTER` notifier, which may require disabling promiscuous
and/or allmulti mode. Both of these operations require acquiring
the netdev instance lock.

Move the call to `packet_dev_mc` outside of the RCU critical section.
The `mclist` modifications (add, del, flush, unregister) are protected by
the RTNL, not the RCU. The RCU only protects the `sklist` and its
associated `sks`. The delayed operation on the `mclist` entry remains
within the RTNL.

Reported-by: syzbot+b191b5ccad8d7a986286@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b191b5ccad8d7a986286
Fixes: ad7c7b2172c3 ("net: hold netdev instance lock during sysfs operations")
Signed-off-by: Stanislav Fomichev <stfomichev@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250522031129.3247266-1-stfomichev@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d4dba06297c33e38649808797796be4fb135121d..20be2c47cf4191f07073d6d66753563ba711072c 100644 (file)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3713,15 +3713,15 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
 }
 
 static void packet_dev_mclist_delete(struct net_device *dev,
-                                    struct packet_mclist **mlp)
+                                    struct packet_mclist **mlp,
+                                    struct list_head *list)
 {
        struct packet_mclist *ml;
 
        while ((ml = *mlp) != NULL) {
                if (ml->ifindex == dev->ifindex) {
-                       packet_dev_mc(dev, ml, -1);
+                       list_add(&ml->remove_list, list);
                        *mlp = ml->next;
-                       kfree(ml);
                } else
                        mlp = &ml->next;
        }
@@ -3769,6 +3769,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
        memcpy(i->addr, mreq->mr_address, i->alen);
        memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen);
        i->count = 1;
+       INIT_LIST_HEAD(&i->remove_list);
        i->next = po->mclist;
        po->mclist = i;
        err = packet_dev_mc(dev, i, 1);
@@ -4233,9 +4234,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 static int packet_notifier(struct notifier_block *this,
                           unsigned long msg, void *ptr)
 {
-       struct sock *sk;
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
+       struct packet_mclist *ml, *tmp;
+       LIST_HEAD(mclist);
+       struct sock *sk;
 
        rcu_read_lock();
        sk_for_each_rcu(sk, &net->packet.sklist) {
@@ -4244,7 +4247,8 @@ static int packet_notifier(struct notifier_block *this,
                switch (msg) {
                case NETDEV_UNREGISTER:
                        if (po->mclist)
-                               packet_dev_mclist_delete(dev, &po->mclist);
+                               packet_dev_mclist_delete(dev, &po->mclist,
+                                                        &mclist);
                        fallthrough;
 
                case NETDEV_DOWN:
@@ -4277,6 +4281,13 @@ static int packet_notifier(struct notifier_block *this,
                }
        }
        rcu_read_unlock();
+
+       /* packet_dev_mc might grab instance locks so can't run under rcu */
+       list_for_each_entry_safe(ml, tmp, &mclist, remove_list) {
+               packet_dev_mc(dev, ml, -1);
+               kfree(ml);
+       }
+
        return NOTIFY_DONE;
 }
 

diff --git a/net/packet/internal.h b/net/packet/internal.h
index d5d70712007ad32bf1227ee59dcc12e12bbb77e4..1e743d0316fdda573d8987df6a344dfaf6a524b5 100644 (file)
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -11,6 +11,7 @@ struct packet_mclist {
        unsigned short          type;
        unsigned short          alen;
        unsigned char           addr[MAX_ADDR_LEN];
+       struct list_head        remove_list;
 };
 
 /* kbdq - kernel block descriptor queue */