Skip to contentSkip to conversation

hv_netvsc: fix potential deadlock in netvsc_vf_setxdp()

PATCH New Saurabh Sengar 1 participant 1 message May 18, 2025

Subsystems (4)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 hv_netvsc: fix potential deadlock in netvsc_vf_setxdp()

The MANA driver's probe registers netdevice via the following call chain:

mana_probe()
register_netdev()
register_netdevice()

register_netdevice() calls notifier callback for netvsc driver, holding the netdev mutex via netdev_lock_ops().

Further this netvsc notifier callback end up attempting to acquire the same lock again in dev_xdp_propagate() leading to deadlock.

netvsc_netdev_event()
netvsc_vf_setxdp()
dev_xdp_propagate()

This deadlock was not observed so far because net_shaper_ops was never set and this lock in noop in this case. Fix this by using netif_xdp_propagate instead of dev_xdp_propagate to avoid recursive locking in this path.

This issue has not observed so far because net_shaper_ops was unset, making the lock path effectively a no-op. To prevent recursive locking and avoid this deadlock, replace dev_xdp_propagate() with netif_xdp_propagate(), which does not acquire the lock again.

Also, clean up the unregistration path by removing unnecessary call to netvsc_vf_setxdp(), since unregister_netdevice_many_notify() already performs this cleanup via dev_xdp_uninstall.

Fixes 97246d6d21c2 ("net: hold netdev instance lock during ndo_bpf")
---
 drivers/net/hyperv/netvsc_bpf.c | 2 +-
 drivers/net/hyperv/netvsc_drv.c | 2 --
 net/core/dev.c                  | 1 +
 3 files changed, 2 insertions(+), 3 deletions(-)
drivers/net/hyperv/netvsc_bpf.c +1 -1
index e01c5997a551..1dd3755d9e6d 100644
@@ -183,7 +183,7 @@ int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog)
 	xdp.command = XDP_SETUP_PROG;
 	xdp.prog = prog;
 
-	ret = dev_xdp_propagate(vf_netdev, &xdp);
+	ret = netif_xdp_propagate(vf_netdev, &xdp);
 
 	if (ret && prog)
 		bpf_prog_put(prog);
drivers/net/hyperv/netvsc_drv.c +0 -2
index d8b169ac0343..ee3aaf9c10e6 100644
@@ -2462,8 +2462,6 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev)
 
 	netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name);
 
-	netvsc_vf_setxdp(vf_netdev, NULL);
-
 	reinit_completion(&net_device_ctx->vf_add);
 	netdev_rx_handler_unregister(vf_netdev);
 	netdev_upper_dev_unlink(vf_netdev, ndev);
net/core/dev.c +1 -0
index fccf2167b235..8c6c9d7fba26 100644
@@ -9953,6 +9953,7 @@ int netif_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf)
 
 	return dev->netdev_ops->ndo_bpf(dev, bpf);
 }
+EXPORT_SYMBOL_GPL(netif_xdp_propagate);
 
 u32 dev_xdp_prog_id(struct net_device *dev, enum bpf_xdp_mode mode)
 {
Signature · 1 line
2.43.0