Patch "kcm: fix strp_init() order and cleanup" has been added to the 4.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    kcm: fix strp_init() order and cleanup

to the 4.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kcm-fix-strp_init-order-and-cleanup.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c2773e54ee3a7c980b918c874c15368d459fd2f7
Author: Cong Wang <cong.wang@xxxxxxxxxxxxx>
Date:   Sat Aug 27 11:13:14 2022 -0700

    kcm: fix strp_init() order and cleanup
    
    [ Upstream commit 8fc29ff3910f3af08a7c40a75d436b5720efe2bf ]
    
    strp_init() is called just a few lines above this csk->sk_user_data
    check, it also initializes strp->work etc., therefore, it is
    unnecessary to call strp_done() to cancel the freshly initialized
    work.
    
    And if sk_user_data is already used by KCM, psock->strp should not be
    touched, particularly strp->work state, so we need to move strp_init()
    after the csk->sk_user_data check.
    
    This also makes a lockdep warning reported by syzbot go away.
    
    Reported-and-tested-by: syzbot+9fc084a4348493ef65d2@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reported-by: syzbot+e696806ef96cdd2d87cd@xxxxxxxxxxxxxxxxxxxxxxxxx
    Fixes: e5571240236c ("kcm: Check if sk_user_data already set in kcm_attach")
    Fixes: dff8baa26117 ("kcm: Call strp_stop before strp_done in kcm_attach")
    Cc: Tom Herbert <tom@xxxxxxxxxxxxxxx>
    Signed-off-by: Cong Wang <cong.wang@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20220827181314.193710-1-xiyou.wangcong@xxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 7b4f3f8658617..c364d849e7c3d 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
 	psock->sk = csk;
 	psock->bpf_prog = prog;
 
-	err = strp_init(&psock->strp, csk, &cb);
-	if (err) {
-		kmem_cache_free(kcm_psockp, psock);
-		goto out;
-	}
-
 	write_lock_bh(&csk->sk_callback_lock);
 
 	/* Check if sk_user_data is aready by KCM or someone else.
@@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
 	 */
 	if (csk->sk_user_data) {
 		write_unlock_bh(&csk->sk_callback_lock);
-		strp_stop(&psock->strp);
-		strp_done(&psock->strp);
 		kmem_cache_free(kcm_psockp, psock);
 		err = -EALREADY;
 		goto out;
 	}
 
+	err = strp_init(&psock->strp, csk, &cb);
+	if (err) {
+		write_unlock_bh(&csk->sk_callback_lock);
+		kmem_cache_free(kcm_psockp, psock);
+		goto out;
+	}
+
 	psock->save_data_ready = csk->sk_data_ready;
 	psock->save_write_space = csk->sk_write_space;
 	psock->save_state_change = csk->sk_state_change;