| Message ID | 20250113161842.134350-1-atenart@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: avoid race between device unregistration and set_channels | expand |
diff --git a/net/core/dev.c b/net/core/dev.c index a9f62f5aeb84..d8491a275e2e 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10931,6 +10931,8 @@ void netdev_run_todo(void) WARN_ON(rcu_access_pointer(dev->ip_ptr)); WARN_ON(rcu_access_pointer(dev->ip6_ptr)); + mutex_destroy(&dev->ethtool->rss_lock); + netdev_do_free_pcpu_stats(dev); if (dev->priv_destructor) dev->priv_destructor(dev); @@ -11566,8 +11568,6 @@ void unregister_netdevice_many_notify(struct list_head *head, if (dev->netdev_ops->ndo_uninit) dev->netdev_ops->ndo_uninit(dev); - mutex_destroy(&dev->ethtool->rss_lock); - net_shaper_flush_netdev(dev); if (skb)
The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120 CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771 RIP: 0010:__mutex_lock+0xc8a/0x1120 Call Trace: <TASK> ethtool_check_max_channel+0x1ea/0x880 ethnl_set_channels+0x3c3/0xb10 ethnl_default_set_doit+0x306/0x650 genl_family_rcv_msg_doit+0x1e3/0x2c0 genl_rcv_msg+0x432/0x6f0 netlink_rcv_skb+0x13d/0x3b0 genl_rcv+0x28/0x40 netlink_unicast+0x42e/0x720 netlink_sendmsg+0x765/0xc20 __sys_sendto+0x3ac/0x420 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e This is because unregister_netdevice_many_notify might run before set_channels (both are under rtnl). When that happens, the rss lock is being destroyed before being used again. Fix this by destroying the rss lock in run_todo, outside an rtnl lock section and after all references to net devices are gone. Note that allowing to run set_channels after the rtnl section of the unregistration path should be fine as it still runs before the destructors (thanks to refcount). This patch does not change that. Fixes: 87925151191b ("net: ethtool: add a mutex protecting RSS contexts") Cc: Edward Cree <ecree.xilinx@gmail.com> Signed-off-by: Antoine Tenart <atenart@kernel.org> --- net/core/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)