[PATCH v5.10] bpf: fix recursive lock when verdict program return SK_PASS

[PATCH v5.10] bpf: fix recursive lock when verdict program return SK_PASS

[Srish Srinivasan]

From: Jiayuan Chen <mrpre@163.com>

commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream.

When the stream_verdict program returns SK_PASS, it places the received skb
into its own receive queue, but a recursive lock eventually occurs, leading
to an operating system deadlock. This issue has been present since v6.9.

'''
sk_psock_strp_data_ready
    write_lock_bh(&sk->sk_callback_lock)
    strp_data_ready
      strp_read_sock
        read_sock -> tcp_read_sock
          strp_recv
            cb.rcv_msg -> sk_psock_strp_read
              # now stream_verdict return SK_PASS without peer sock assign
              __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)
              sk_psock_verdict_apply
                sk_psock_skb_ingress_self
                  sk_psock_skb_ingress_enqueue
                    sk_psock_data_ready
                      read_lock_bh(&sk->sk_callback_lock) <= dead lock

'''

This topic has been discussed before, but it has not been fixed.
Previous discussion:
https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch

Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue")
Reported-by: Vincent Whitchurch <vincent.whitchurch@datadoghq.com>
Signed-off-by: Jiayuan Chen <mrpre@163.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[srish: Apply to stable branch linux-5.10.y]
Signed-off-by: Srish Srinivasan <srishwap4@gmail.com>
---
 net/core/skmsg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 51792dda1..890e16bbc 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -940,9 +940,9 @@ static void sk_psock_strp_data_ready(struct sock *sk)
 		if (tls_sw_has_ctx_rx(sk)) {
 			psock->parser.saved_data_ready(sk);
 		} else {
-			write_lock_bh(&sk->sk_callback_lock);
+			read_lock_bh(&sk->sk_callback_lock);
 			strp_data_ready(&psock->parser.strp);
-			write_unlock_bh(&sk->sk_callback_lock);
+			read_unlock_bh(&sk->sk_callback_lock);
 		}
 	}
 	rcu_read_unlock();
-- 
2.25.1

Re: [PATCH v5.10] bpf: fix recursive lock when verdict program return SK_PASS

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 8ca2a1eeadf09862190b2810697702d803ceef2d

WARNING: Author mismatch between patch and upstream commit:
Backport author: Srish Srinivasan<srishwap4@gmail.com>
Commit author: Jiayuan Chen<mrpre@163.com>


Status in newer kernel trees:
6.12.y | Present (different SHA1: f84c5ef6ca23)
6.6.y | Present (different SHA1: da2bc8a0c8f3)
6.1.y | Present (different SHA1: 386efa339e08)
5.15.y | Present (different SHA1: 6694f7acd625)
5.10.y | Not found

Note: The patch differs from the upstream commit:
---
1:  8ca2a1eeadf0 ! 1:  3487de836032 bpf: fix recursive lock when verdict program return SK_PASS
    @@ Metadata
      ## Commit message ##
         bpf: fix recursive lock when verdict program return SK_PASS
     
    +    commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream.
    +
         When the stream_verdict program returns SK_PASS, it places the received skb
         into its own receive queue, but a recursive lock eventually occurs, leading
         to an operating system deadlock. This issue has been present since v6.9.
    @@ Commit message
         Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
         Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com
         Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    +    Signed-off-by: Sasha Levin <sashal@kernel.org>
    +    [srish: Apply to stable branch linux-5.10.y]
    +    Signed-off-by: Srish Srinivasan <srishwap4@gmail.com>
     
      ## net/core/skmsg.c ##
     @@ net/core/skmsg.c: static void sk_psock_strp_data_ready(struct sock *sk)
      		if (tls_sw_has_ctx_rx(sk)) {
    - 			psock->saved_data_ready(sk);
    + 			psock->parser.saved_data_ready(sk);
      		} else {
     -			write_lock_bh(&sk->sk_callback_lock);
     +			read_lock_bh(&sk->sk_callback_lock);
    - 			strp_data_ready(&psock->strp);
    + 			strp_data_ready(&psock->parser.strp);
     -			write_unlock_bh(&sk->sk_callback_lock);
     +			read_unlock_bh(&sk->sk_callback_lock);
      		}
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y       |  Success    |  Success   |