Patch "dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dccp-put-dccp_qpolicy_full-and-dccp_qpolicy_push-in-.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9d682186e7b4f4045e5fbeece08aede453af280a
Author: Hangyu Hua <hbh25y@xxxxxxxxx>
Date:   Fri Jul 29 19:00:27 2022 +0800

    dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
    
    [ Upstream commit a41b17ff9dacd22f5f118ee53d82da0f3e52d5e3 ]
    
    In the case of sk->dccps_qpolicy == DCCPQ_POLICY_PRIO, dccp_qpolicy_full
    will drop a skb when qpolicy is full. And the lock in dccp_sendmsg is
    released before sock_alloc_send_skb and then relocked after
    sock_alloc_send_skb. The following conditions may lead dccp_qpolicy_push
    to add skb to an already full sk_write_queue:
    
    thread1--->lock
    thread1--->dccp_qpolicy_full: queue is full. drop a skb
    thread1--->unlock
    thread2--->lock
    thread2--->dccp_qpolicy_full: queue is not full. no need to drop.
    thread2--->unlock
    thread1--->lock
    thread1--->dccp_qpolicy_push: add a skb. queue is full.
    thread1--->unlock
    thread2--->lock
    thread2--->dccp_qpolicy_push: add a skb!
    thread2--->unlock
    
    Fix this by moving dccp_qpolicy_full.
    
    Fixes: b1308dc015eb ("[DCCP]: Set TX Queue Length Bounds via Sysctl")
    Signed-off-by: Hangyu Hua <hbh25y@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20220729110027.40569-1-hbh25y@xxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index cb61a9d281f6..951cbdf05ffe 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -765,11 +765,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 
 	lock_sock(sk);
 
-	if (dccp_qpolicy_full(sk)) {
-		rc = -EAGAIN;
-		goto out_release;
-	}
-
 	timeo = sock_sndtimeo(sk, noblock);
 
 	/*
@@ -788,6 +783,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	if (skb == NULL)
 		goto out_release;
 
+	if (dccp_qpolicy_full(sk)) {
+		rc = -EAGAIN;
+		goto out_discard;
+	}
+
 	if (sk->sk_state == DCCP_CLOSED) {
 		rc = -ENOTCONN;
 		goto out_discard;