Fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.4/bpf-fix-recursive-lock-when-verdict-program-return-s.patch b/queue-5.4/bpf-fix-recursive-lock-when-verdict-program-return-s.patch
new file mode 100644 (file)
index 0000000..85f33c2
--- /dev/null
+++ b/queue-5.4/bpf-fix-recursive-lock-when-verdict-program-return-s.patch
@@ -0,0 +1,69 @@
+From 852d11d7508550e6d3a8bc99d07ee3292af1feb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Dec 2024 00:44:15 +0530
+Subject: bpf: fix recursive lock when verdict program return SK_PASS
+
+From: Jiayuan Chen <mrpre@163.com>
+
+commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream.
+
+When the stream_verdict program returns SK_PASS, it places the received skb
+into its own receive queue, but a recursive lock eventually occurs, leading
+to an operating system deadlock. This issue has been present since v6.9.
+
+'''
+sk_psock_strp_data_ready
+    write_lock_bh(&sk->sk_callback_lock)
+    strp_data_ready
+      strp_read_sock
+        read_sock -> tcp_read_sock
+          strp_recv
+            cb.rcv_msg -> sk_psock_strp_read
+              # now stream_verdict return SK_PASS without peer sock assign
+              __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)
+              sk_psock_verdict_apply
+                sk_psock_skb_ingress_self
+                  sk_psock_skb_ingress_enqueue
+                    sk_psock_data_ready
+                      read_lock_bh(&sk->sk_callback_lock) <= dead lock
+
+'''
+
+This topic has been discussed before, but it has not been fixed.
+Previous discussion:
+https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch
+
+Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue")
+Reported-by: Vincent Whitchurch <vincent.whitchurch@datadoghq.com>
+Signed-off-by: Jiayuan Chen <mrpre@163.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+[srish: Apply to stable branch linux-5.10.y]
+Signed-off-by: Srish Srinivasan <srishwap4@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index a606ad8e8be2..dfc2e4d6a7a0 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -904,9 +904,9 @@ static void sk_psock_strp_data_ready(struct sock *sk)
+               if (tls_sw_has_ctx_rx(sk)) {
+                       psock->parser.saved_data_ready(sk);
+               } else {
+-                      write_lock_bh(&sk->sk_callback_lock);
++                      read_lock_bh(&sk->sk_callback_lock);
+                       strp_data_ready(&psock->parser.strp);
+-                      write_unlock_bh(&sk->sk_callback_lock);
++                      read_unlock_bh(&sk->sk_callback_lock);
+               }
+       }
+       rcu_read_unlock();
+-- 
+2.39.5
+

diff --git a/queue-5.4/series b/queue-5.4/series
index 5ebc0bf7756796d669b1e5a348dcf79eb0f6eda9..11308a0aa412da6dc186150dd3eacf7fc0aea26d 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -54,3 +54,4 @@ skbuff-introduce-skb_expand_head.patch
 ipv6-use-skb_expand_head-in-ip6_finish_output2.patch
 ipv6-use-skb_expand_head-in-ip6_xmit.patch
 ipv6-fix-possible-uaf-in-ip6_finish_output2.patch
+bpf-fix-recursive-lock-when-verdict-program-return-s.patch