Ido Schimmel 471b83bd8b team: Forbid enslaving team device to itself ... team's ndo_add_slave() acquires 'team->lock' and later tries to open the newly enslaved device via dev_open(). This emits a 'NETDEV_UP' event that causes the VLAN driver to add VLAN 0 on the team device. team's ndo_vlan_rx_add_vid() will also try to acquire 'team->lock' and deadlock. Fix this by checking early at the enslavement function that a team device is not being enslaved to itself. A similar check was added to the bond driver in commit 09a89c219b ("bonding: disallow enslaving a bond to itself"). WARNING: possible recursive locking detected 4.18.0-rc7+ #176 Not tainted -------------------------------------------- syz-executor4/6391 is trying to acquire lock: (____ptrval____) (&team->lock){+.+.}, at: team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868 but task is already holding lock: (____ptrval____) (&team->lock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&team->lock); lock(&team->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by syz-executor4/6391: #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline] #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x412/0xc30 net/core/rtnetlink.c:4662 #1: (____ptrval____) (&team->lock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947 stack backtrace: CPU: 1 PID: 6391 Comm: syz-executor4 Not tainted 4.18.0-rc7+ #176 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 print_deadlock_bug kernel/locking/lockdep.c:1765 [inline] check_deadlock kernel/locking/lockdep.c:1809 [inline] validate_chain kernel/locking/lockdep.c:2405 [inline] __lock_acquire.cold.64+0x1fb/0x486 kernel/locking/lockdep.c:3435 lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924 __mutex_lock_common kernel/locking/mutex.c:757 [inline] __mutex_lock+0x176/0x1820 kernel/locking/mutex.c:894 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:909 team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868 vlan_add_rx_filter_info+0x14a/0x1d0 net/8021q/vlan_core.c:210 __vlan_vid_add net/8021q/vlan_core.c:278 [inline] vlan_vid_add+0x63e/0x9d0 net/8021q/vlan_core.c:308 vlan_device_event.cold.12+0x2a/0x2f net/8021q/vlan.c:381 notifier_call_chain+0x180/0x390 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1735 call_netdevice_notifiers net/core/dev.c:1753 [inline] dev_open+0x173/0x1b0 net/core/dev.c:1433 team_port_add drivers/net/team/team.c:1219 [inline] team_add_slave+0xa8b/0x1c30 drivers/net/team/team.c:1948 do_set_master+0x1c9/0x220 net/core/rtnetlink.c:2248 do_setlink+0xba4/0x3e10 net/core/rtnetlink.c:2382 rtnl_setlink+0x2a9/0x400 net/core/rtnetlink.c:2636 rtnetlink_rcv_msg+0x46e/0xc30 net/core/rtnetlink.c:4665 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2455 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4683 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343 netlink_sendmsg+0xa18/0xfd0 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:642 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:652 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2126 __sys_sendmsg+0x11d/0x290 net/socket.c:2164 __do_sys_sendmsg net/socket.c:2173 [inline] __se_sys_sendmsg net/socket.c:2171 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2171 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x456b29 Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f9706bf8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9706bf96d4 RCX: 0000000000456b29 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000004d3548 R14: 00000000004c8227 R15: 0000000000000000 Fixes: 87002b03ba ("net: introduce vlan_vid_[add/del] and use them instead of direct [add/kill]_vid ndo calls") Signed-off-by: Ido Schimmel <idosch@mellanox.com> Reported-and-tested-by: syzbot+bd051aba086537515cdb@syzkaller.appspotmail.com Signed-off-by: David S. Miller <davem@davemloft.net>		2018-10-04 13:55:40 -07:00
..
accessibility
acpi
amba
android
ata	for-linus-20180920	2018-09-21 09:41:05 +02:00
atm
auxdisplay
base
bcma
block	for-linus-20180929	2018-09-29 14:52:14 -07:00
bluetooth
bus
cdrom
char
clk	clk: x86: Stop marking clocks as CLK_IS_CRITICAL	2018-09-17 18:47:58 -07:00
clocksource	clocksource/drivers/timer-atmel-pit: Properly handle error cases	2018-09-27 12:01:45 +02:00
connector
cpufreq	cpufreq: qcom-kryo: Fix section annotations	2018-09-29 15:01:10 +02:00
cpuidle
crypto
dax	device-dax: Add missing address_space_operations	2018-09-22 09:07:33 -07:00
dca
devfreq
dio
dma
dma-buf
edac
eisa
extcon
firewire
firmware
fmc
fpga
fsi
gnss
gpio
gpu	Merge branch 'drm-fixes-4.19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes	2018-09-28 09:30:22 +10:00
hid	HID: intel-ish-hid: Enable Ice Lake mobile	2018-09-24 11:46:15 +02:00
hsi
hv
hwmon	Various bug fixes for nct6775 driver	2018-09-19 22:59:30 +02:00
hwspinlock
hwtracing	intel_th: pci: Add Ice Lake PCH support	2018-09-18 16:08:38 +02:00
i2c
ide
idle
iio
infiniband	Second rc pull request	2018-09-27 21:53:55 +02:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2018-09-28 18:04:50 -07:00
iommu	iommu/amd: Return devid as alias for ACPI HID devices	2018-09-26 09:41:11 +02:00
ipack
irqchip
isdn
leds
lightnvm
macintosh
mailbox
mcb
md	for-linus-20180929	2018-09-29 14:52:14 -07:00
media	media: v4l: event: Prevent freeing event subscriptions while accessed	2018-10-03 06:32:51 -04:00
memory
memstick
message
mfd
misc
mmc	mmc: slot-gpio: Fix debounce time to use miliseconds again	2018-09-28 17:43:48 +02:00
mtd	mtd: devices: m25p80: Make sure the buffer passed in op is DMA-able	2018-09-18 10:17:48 +02:00
mux
net	team: Forbid enslaving team device to itself	2018-10-04 13:55:40 -07:00
nfc
ntb
nubus
nvdimm
nvme	nvme: properly propagate errors in nvme_mpath_init	2018-09-25 16:21:40 -07:00
nvmem
of	Devicetree fixes for 4.19, part 2:	2018-09-14 13:03:17 -10:00
opp
oprofile
parisc
parport
pci	pci-v4.19-fixes-2	2018-09-28 18:20:41 +02:00
pcmcia
perf
phy
pinctrl	Revert "pinctrl: intel: Do pin translation when lock IRQ"	2018-09-25 12:50:00 +02:00
platform
pnp
power
powercap
pps
ps3
ptp
pwm
rapidio
ras
regulator	regulator: fix crash caused by null driver data	2018-09-20 09:04:51 -07:00
remoteproc
reset
rpmsg
rtc
s390	s390: qeth: Fix potential array overrun in cmd/rc lookup	2018-09-28 10:27:26 -07:00
sbus
scsi	scsi: sd: don't crash the host on invalid commands	2018-09-21 12:42:57 -04:00
sfi
sh
siox
slimbus
sn
soc	soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift()	2018-09-25 13:57:26 -07:00
soundwire
spi	spi: Fixes for v4.19	2018-09-28 18:04:06 -07:00
spmi
ssb
staging	media fixes for v4.19-rc5	2018-09-24 15:16:41 +02:00
target	scsi: target: iscsi: Use bin2hex instead of a re-implementation	2018-09-21 12:32:30 -04:00
tc
tee
thermal
thunderbolt
tty	serial: imx: restore handshaking irq for imx1	2018-09-20 14:51:31 +02:00
uio
usb	usb: typec: mux: Take care of driver module reference counting	2018-09-20 13:35:01 +02:00
uwb
vfio
vhost
video	video/fbdev/stifb: Fix spelling mistake in fall-through annotation	2018-09-26 18:50:54 +02:00
virt
virtio
visorbus
vlynq
vme
w1
watchdog
xen	xen: issue warning message when out of grant maptrack entries	2018-09-19 11:27:42 -04:00
zorro
Kconfig
Makefile