[PATCH] netdevsim: Fix deadlock in del_device_store() and nsim_bus_exit()
From: Moksh Panicker <hidden>
Date: 2026-06-16 22:26:56
Also in:
lkml
Subsystem:
netdevsim, networking drivers, the rest · Maintainers:
Jakub Kicinski, Andrew Lunn, "David S. Miller", Eric Dumazet, Paolo Abeni, Linus Torvalds
del_device_store() and nsim_bus_exit() both hold nsim_bus_dev_list_lock while calling nsim_bus_dev_del(), which calls device_unregister() which internally acquires the device lock. If another thread already holds the device lock and tries to acquire nsim_bus_dev_list_lock, a deadlock occurs: INFO: task hung in nsim_bus_dev_del Fix this by releasing nsim_bus_dev_list_lock before calling nsim_bus_dev_del() in both locations, after the devices have already been removed from the list with list_del(). Reported-by: syzbot+1cf303af03cf30b1275a@syzkaller.appspot.com Closes: https://syzkaller.appspot.com/bug?extid=1cf303af03cf30b1275a Signed-off-by: Moksh Panicker <redacted> --- drivers/net/netdevsim/bus.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
index 41483e371..0f02ff8ad 100644
--- a/drivers/net/netdevsim/bus.c
+++ b/drivers/net/netdevsim/bus.c@@ -241,11 +241,12 @@ del_device_store(const struct bus_type *bus, const char *buf, size_t count) if (nsim_bus_dev->dev.id != id) continue; list_del(&nsim_bus_dev->list); - nsim_bus_dev_del(nsim_bus_dev); err = 0; break; } mutex_unlock(&nsim_bus_dev_list_lock); + if (!err) + nsim_bus_dev_del(nsim_bus_dev); return !err ? count : err; } static BUS_ATTR_WO(del_device);
@@ -527,11 +528,11 @@ void nsim_bus_exit(void) complete(&nsim_bus_devs_released); mutex_lock(&nsim_bus_dev_list_lock); - list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) { + list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) list_del(&nsim_bus_dev->list); - nsim_bus_dev_del(nsim_bus_dev); - } mutex_unlock(&nsim_bus_dev_list_lock); + list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) + nsim_bus_dev_del(nsim_bus_dev); wait_for_completion(&nsim_bus_devs_released);
--
2.34.1