@@ -1278,13 +1278,14 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
* tell the caller to replay the request. We
* indicate this using -EAGAIN.
* We replay the request because the device may
- * go away in the mean time.
+ * go away in the mean time. Note that we also
+ * don't relock the device because it might
+ * be gone at this point.
*/
netdev_unlock_ops(dev);
rtnl_unlock();
request_module(NET_SCH_ALIAS_PREFIX "%s", name);
rtnl_lock();
- netdev_lock_ops(dev);
ops = qdisc_lookup_ops(kind);
if (ops != NULL) {
/* We will try again qdisc_lookup_ops,
@@ -1837,9 +1838,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
replay = false;
netdev_lock_ops(dev);
err = __tc_modify_qdisc(skb, n, extack, dev, tca, tcm, &replay);
- netdev_unlock_ops(dev);
+ /* __tc_modify_qdisc returns with unlocked dev in case of replay */
if (replay)
goto replay;
+ netdev_unlock_ops(dev);
return err;
}
Eric reports that by the time we call netdev_lock_ops after rtnl_unlock/rtnl_lock, the dev might point to an invalid device. Don't relock the device after request_module and don't try to unlock it in the caller (tc_modify_qdisc) in case of replay. Fixes: a0527ee2df3f ("net: hold netdev instance lock during qdisc ndo_setup_tc") Reported-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/netdev/20250305163732.2766420-1-sdf@fomichev.me/T/#me8dfd778ea4c4463acab55644e3f9836bc608771 Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> --- net/sched/sch_api.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)