Subject: possible deadlock in ppp_dev_uninit

From: syzbot <[email-masked]>
Date: Fri, 05 Jan 2018 10:41:00 -0800

Hello,

syzbot tried to test the proposed patch but build/boot failed:

failed to copy test binary to VM: failed to run /usr/bin/scp [scp -P 22 -i  
/syzkaller/jobs/linux/image/key -F /dev/null -o  
UserKnownHostsFile=/dev/null -o BatchMode=yes -o IdentitiesOnly=yes -o  
StrictHostKeyChecking=no -o ConnectTimeout=10 /tmp/syzkaller180475523  
[email-masked]:./syzkaller180475523]: exit status 1
ssh: connect to host 10.128.0.60 port 22: Connection timed out
lost connection

Tested on commit d1616f07e8f1a4a490d1791316d4a68906b284aa
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/master
compiler: gcc (GCC) 7.1.1 20170620
Patch is attached.
Kernel config is attached.

--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1006,17 +1006,18 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set)
        if (!ifname_is_set)
                snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index);
 
+       mutex_unlock(&pn->all_ppp_mutex);
+
        ret = register_netdevice(ppp->dev);
        if (ret < 0)
                goto err_unit;
 
        atomic_inc(&ppp_unit_count);
 
-       mutex_unlock(&pn->all_ppp_mutex);
-
        return 0;
 
 err_unit:
+       mutex_lock(&pn->all_ppp_mutex);
        unit_put(&pn->units_idr, ppp->file.index);
 err:
        mutex_unlock(&pn->all_ppp_mutex);