From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 26 Feb 2018 08:33:14 +0000 (+0100)
Subject: 4.4-stable patches
X-Git-Tag: v3.18.97~25
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=031e8bc825ac6affd322e743628cb94d48e3e1cd;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	netfilter-drop-outermost-socket-lock-in-getsockopt.patch
---

diff --git a/queue-4.4/netfilter-drop-outermost-socket-lock-in-getsockopt.patch b/queue-4.4/netfilter-drop-outermost-socket-lock-in-getsockopt.patch
new file mode 100644
index 00000000000..df795b21199
--- /dev/null
+++ b/queue-4.4/netfilter-drop-outermost-socket-lock-in-getsockopt.patch
@@ -0,0 +1,101 @@
+From 01ea306f2ac2baff98d472da719193e738759d93 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Thu, 8 Feb 2018 12:19:00 +0100
+Subject: netfilter: drop outermost socket lock in getsockopt()
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 01ea306f2ac2baff98d472da719193e738759d93 upstream.
+
+The Syzbot reported a possible deadlock in the netfilter area caused by
+rtnl lock, xt lock and socket lock being acquired with a different order
+on different code paths, leading to the following backtrace:
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+
+======================================================
+WARNING: possible circular locking dependency detected
+4.15.0+ #301 Not tainted
+------------------------------------------------------
+syzkaller233489/4179 is trying to acquire lock:
+  (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20
+net/core/rtnetlink.c:74
+
+but task is already holding lock:
+  (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]
+xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041
+
+which lock already depends on the new lock.
+===
+
+Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock
+only in the required scope"), we already acquire the socket lock in
+the innermost scope, where needed. In such commit I forgot to remove
+the outer-most socket lock from the getsockopt() path, this commit
+addresses the issues dropping it now.
+
+v1 -> v2: fix bad subj, added relavant 'fixes' tag
+
+Fixes: 22265a5c3c10 ("netfilter: xt_TEE: resolve oif using netdevice notifiers")
+Fixes: 202f59afd441 ("netfilter: ipt_CLUSTERIP: do not hold dev")
+Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope")
+Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com
+Suggested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ip_sockglue.c   |    7 +------
+ net/ipv6/ipv6_sockglue.c |   10 ++--------
+ 2 files changed, 3 insertions(+), 14 deletions(-)
+
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1527,10 +1527,7 @@ int ip_getsockopt(struct sock *sk, int l
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		err = nf_getsockopt(sk, PF_INET, optname, optval,
+-				&len);
+-		release_sock(sk);
++		err = nf_getsockopt(sk, PF_INET, optname, optval, &len);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 		return err;
+@@ -1562,9 +1559,7 @@ int compat_ip_getsockopt(struct sock *sk
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+ 		err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len);
+-		release_sock(sk);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 		return err;
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -1340,10 +1340,7 @@ int ipv6_getsockopt(struct sock *sk, int
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		err = nf_getsockopt(sk, PF_INET6, optname, optval,
+-				&len);
+-		release_sock(sk);
++		err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 	}
+@@ -1382,10 +1379,7 @@ int compat_ipv6_getsockopt(struct sock *
+ 		if (get_user(len, optlen))
+ 			return -EFAULT;
+ 
+-		lock_sock(sk);
+-		err = compat_nf_getsockopt(sk, PF_INET6,
+-					   optname, optval, &len);
+-		release_sock(sk);
++		err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len);
+ 		if (err >= 0)
+ 			err = put_user(len, optlen);
+ 	}