From bc440b67fce0e0a57deea00b301300f247faac07 Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Thu, 15 Dec 2022 19:27:39 -0800 Subject: [PATCH] Don't hold nic.mu when calling n.linkResQueue.cancel. Reported-by: syzbot+0a308dd93b1cc6f98dcb@syzkaller.appspotmail.com PiperOrigin-RevId: 495756802 --- pkg/tcpip/stack/nic.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/tcpip/stack/nic.go b/pkg/tcpip/stack/nic.go index ee7cd31c6..38b71f67a 100644 --- a/pkg/tcpip/stack/nic.go +++ b/pkg/tcpip/stack/nic.go @@ -299,7 +299,6 @@ func (n *nic) enable() tcpip.Error { // stack. func (n *nic) remove() tcpip.Error { n.mu.Lock() - defer n.mu.Unlock() n.disableLocked() @@ -307,10 +306,13 @@ func (n *nic) remove() tcpip.Error { ep.Close() } + n.mu.Unlock() + // Shutdown GRO. n.gro.close() - // drain and drop any packets pending link resolution. + // Drain and drop any packets pending link resolution. + // We must not hold n.mu here. n.linkResQueue.cancel() // Prevent packets from going down to the link before shutting the link down.