From: Sasha Levin Date: Mon, 30 Dec 2024 01:33:20 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v6.1.123~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2614ee5748dc44f82bb72eeb51db634fb6e995c7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/bpf-fix-recursive-lock-when-verdict-program-return-s.patch b/queue-5.4/bpf-fix-recursive-lock-when-verdict-program-return-s.patch new file mode 100644 index 00000000000..85f33c24646 --- /dev/null +++ b/queue-5.4/bpf-fix-recursive-lock-when-verdict-program-return-s.patch @@ -0,0 +1,69 @@ +From 852d11d7508550e6d3a8bc99d07ee3292af1feb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Dec 2024 00:44:15 +0530 +Subject: bpf: fix recursive lock when verdict program return SK_PASS + +From: Jiayuan Chen + +commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream. + +When the stream_verdict program returns SK_PASS, it places the received skb +into its own receive queue, but a recursive lock eventually occurs, leading +to an operating system deadlock. This issue has been present since v6.9. + +''' +sk_psock_strp_data_ready + write_lock_bh(&sk->sk_callback_lock) + strp_data_ready + strp_read_sock + read_sock -> tcp_read_sock + strp_recv + cb.rcv_msg -> sk_psock_strp_read + # now stream_verdict return SK_PASS without peer sock assign + __SK_PASS = sk_psock_map_verd(SK_PASS, NULL) + sk_psock_verdict_apply + sk_psock_skb_ingress_self + sk_psock_skb_ingress_enqueue + sk_psock_data_ready + read_lock_bh(&sk->sk_callback_lock) <= dead lock + +''' + +This topic has been discussed before, but it has not been fixed. +Previous discussion: +https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch + +Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue") +Reported-by: Vincent Whitchurch +Signed-off-by: Jiayuan Chen +Signed-off-by: John Fastabend +Acked-by: Martin KaFai Lau +Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +[srish: Apply to stable branch linux-5.10.y] +Signed-off-by: Srish Srinivasan +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index a606ad8e8be2..dfc2e4d6a7a0 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -904,9 +904,9 @@ static void sk_psock_strp_data_ready(struct sock *sk) + if (tls_sw_has_ctx_rx(sk)) { + psock->parser.saved_data_ready(sk); + } else { +- write_lock_bh(&sk->sk_callback_lock); ++ read_lock_bh(&sk->sk_callback_lock); + strp_data_ready(&psock->parser.strp); +- write_unlock_bh(&sk->sk_callback_lock); ++ read_unlock_bh(&sk->sk_callback_lock); + } + } + rcu_read_unlock(); +-- +2.39.5 + diff --git a/queue-5.4/series b/queue-5.4/series index 5ebc0bf7756..11308a0aa41 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -54,3 +54,4 @@ skbuff-introduce-skb_expand_head.patch ipv6-use-skb_expand_head-in-ip6_finish_output2.patch ipv6-use-skb_expand_head-in-ip6_xmit.patch ipv6-fix-possible-uaf-in-ip6_finish_output2.patch +bpf-fix-recursive-lock-when-verdict-program-return-s.patch