From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-bl2nam02on0134.outbound.protection.outlook.com ([104.47.38.134]:26720 "EHLO NAM02-BL2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032610AbeCAPjg (ORCPT ); Thu, 1 Mar 2018 10:39:36 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Paolo Abeni , Pablo Neira Ayuso , Sasha Levin Subject: [added to the 4.1 stable tree] netfilter: drop outermost socket lock in getsockopt() Date: Thu, 1 Mar 2018 15:27:51 +0000 Message-ID: <20180301152116.1486-504-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Paolo Abeni This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit 01ea306f2ac2baff98d472da719193e738759d93 ] The Syzbot reported a possible deadlock in the netfilter area caused by rtnl lock, xt lock and socket lock being acquired with a different order on different code paths, leading to the following backtrace: Reviewed-by: Xin Long =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D WARNING: possible circular locking dependency detected 4.15.0+ #301 Not tainted ------------------------------------------------------ syzkaller233489/4179 is trying to acquire lock: (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:74 but task is already holding lock: (&xt[i].mutex){+.+.}, at: [<00000000328553a2>] xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041 which lock already depends on the new lock. =3D=3D=3D Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope"), we already acquire the socket lock in the innermost scope, where needed. In such commit I forgot to remove the outer-most socket lock from the getsockopt() path, this commit addresses the issues dropping it now. v1 -> v2: fix bad subj, added relavant 'fixes' tag Fixes: 22265a5c3c10 ("netfilter: xt_TEE: resolve oif using netdevice notifi= ers") Fixes: 202f59afd441 ("netfilter: ipt_CLUSTERIP: do not hold dev") Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the= required scope") Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com Suggested-by: Florian Westphal Signed-off-by: Paolo Abeni Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/ipv4/ip_sockglue.c | 7 +------ net/ipv6/ipv6_sockglue.c | 10 ++-------- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index c32c3dd2f639..67c1333422a4 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1491,10 +1491,7 @@ int ip_getsockopt(struct sock *sk, int level, if (get_user(len, optlen)) return -EFAULT; =20 - lock_sock(sk); - err =3D nf_getsockopt(sk, PF_INET, optname, optval, - &len); - release_sock(sk); + err =3D nf_getsockopt(sk, PF_INET, optname, optval, &len); if (err >=3D 0) err =3D put_user(len, optlen); return err; @@ -1526,9 +1523,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, = int optname, if (get_user(len, optlen)) return -EFAULT; =20 - lock_sock(sk); err =3D compat_nf_getsockopt(sk, PF_INET, optname, optval, &len); - release_sock(sk); if (err >=3D 0) err =3D put_user(len, optlen); return err; diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 0e2da9f8d6bb..2ad727bba3a5 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -1331,10 +1331,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int = optname, if (get_user(len, optlen)) return -EFAULT; =20 - lock_sock(sk); - err =3D nf_getsockopt(sk, PF_INET6, optname, optval, - &len); - release_sock(sk); + err =3D nf_getsockopt(sk, PF_INET6, optname, optval, &len); if (err >=3D 0) err =3D put_user(len, optlen); } @@ -1373,10 +1370,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int leve= l, int optname, if (get_user(len, optlen)) return -EFAULT; =20 - lock_sock(sk); - err =3D compat_nf_getsockopt(sk, PF_INET6, - optname, optval, &len); - release_sock(sk); + err =3D compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len); if (err >=3D 0) err =3D put_user(len, optlen); } --=20 2.14.1