From: Jiayuan Chen mrpre@163.com
commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream.
When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9.
''' sk_psock_strp_data_ready write_lock_bh(&sk->sk_callback_lock) strp_data_ready strp_read_sock read_sock -> tcp_read_sock strp_recv cb.rcv_msg -> sk_psock_strp_read # now stream_verdict return SK_PASS without peer sock assign __SK_PASS = sk_psock_map_verd(SK_PASS, NULL) sk_psock_verdict_apply sk_psock_skb_ingress_self sk_psock_skb_ingress_enqueue sk_psock_data_ready read_lock_bh(&sk->sk_callback_lock) <= dead lock
'''
This topic has been discussed before, but it has not been fixed. Previous discussion: https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch
Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue") Reported-by: Vincent Whitchurch vincent.whitchurch@datadoghq.com Signed-off-by: Jiayuan Chen mrpre@163.com Signed-off-by: John Fastabend john.fastabend@gmail.com Acked-by: Martin KaFai Lau martin.lau@kernel.org Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org [srish: Apply to stable branch linux-5.10.y] Signed-off-by: Srish Srinivasan srishwap4@gmail.com --- net/core/skmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 51792dda1..890e16bbc 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -940,9 +940,9 @@ static void sk_psock_strp_data_ready(struct sock *sk) if (tls_sw_has_ctx_rx(sk)) { psock->parser.saved_data_ready(sk); } else { - write_lock_bh(&sk->sk_callback_lock); + read_lock_bh(&sk->sk_callback_lock); strp_data_ready(&psock->parser.strp); - write_unlock_bh(&sk->sk_callback_lock); + read_unlock_bh(&sk->sk_callback_lock); } } rcu_read_unlock();
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 8ca2a1eeadf09862190b2810697702d803ceef2d
WARNING: Author mismatch between patch and upstream commit: Backport author: Srish Srinivasansrishwap4@gmail.com Commit author: Jiayuan Chenmrpre@163.com
Status in newer kernel trees: 6.12.y | Present (different SHA1: f84c5ef6ca23) 6.6.y | Present (different SHA1: da2bc8a0c8f3) 6.1.y | Present (different SHA1: 386efa339e08) 5.15.y | Present (different SHA1: 6694f7acd625) 5.10.y | Not found
Note: The patch differs from the upstream commit: --- 1: 8ca2a1eeadf0 ! 1: 3487de836032 bpf: fix recursive lock when verdict program return SK_PASS @@ Metadata ## Commit message ## bpf: fix recursive lock when verdict program return SK_PASS
+ commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream. + When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9. @@ Commit message Acked-by: Martin KaFai Lau martin.lau@kernel.org Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com Signed-off-by: Jakub Kicinski kuba@kernel.org + Signed-off-by: Sasha Levin sashal@kernel.org + [srish: Apply to stable branch linux-5.10.y] + Signed-off-by: Srish Srinivasan srishwap4@gmail.com
## net/core/skmsg.c ## @@ net/core/skmsg.c: static void sk_psock_strp_data_ready(struct sock *sk) if (tls_sw_has_ctx_rx(sk)) { - psock->saved_data_ready(sk); + psock->parser.saved_data_ready(sk); } else { - write_lock_bh(&sk->sk_callback_lock); + read_lock_bh(&sk->sk_callback_lock); - strp_data_ready(&psock->strp); + strp_data_ready(&psock->parser.strp); - write_unlock_bh(&sk->sk_callback_lock); + read_unlock_bh(&sk->sk_callback_lock); } ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Sasha Levin -
Srish Srinivasan