bpf: add missing ops lock around dev_xdp_attach_link

Stanislav Fomichev · kuba-moo · commit d996e412b2df · 2025-04-02T16:06:15.000-07:00
Syzkaller points out that create_link path doesn't grab ops lock, add it. Reported-by: syzbot+08936936fe8132f91f1a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/67e6b3e8.050a0220.2f068f.0079.GAE@google.com/ Fixes: 97246d6 ("net: hold netdev instance lock during ndo_bpf") Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20250331142814.1887506-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -10284,7 +10284,9 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 		goto unlock;
 	}
 
+	netdev_lock_ops(dev);
 	err = dev_xdp_attach_link(dev, &extack, link);
+	netdev_unlock_ops(dev);
 	rtnl_unlock();
 
 	if (err) {

Original file line number	Diff line number	Diff line change
`@@ -10284,7 +10284,9 @@ int bpf_xdp_link_attach(const union bpf_attr attr, struct bpf_prog prog)`
`10284`	`10284`	`goto unlock;`
`10285`	`10285`	`}`
`10286`	`10286`
	`10287`	`+ netdev_lock_ops(dev);`
`10287`	`10288`	`err = dev_xdp_attach_link(dev, &extack, link);`
	`10289`	`+ netdev_unlock_ops(dev);`
`10288`	`10290`	`rtnl_unlock();`
`10289`	`10291`
`10290`	`10292`	`if (err) {`