Patch "l2tp: prevent lockdep issue in l2tp_tunnel_register()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    l2tp: prevent lockdep issue in l2tp_tunnel_register()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     l2tp-prevent-lockdep-issue-in-l2tp_tunnel_register.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 75231560895eb461bf7d18b2f5657553f2600453
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Tue Jan 17 11:01:31 2023 +0000

    l2tp: prevent lockdep issue in l2tp_tunnel_register()
    
    [ Upstream commit b9fb10d131b8c84af9bb14e2078d5c63600c7dea ]
    
    lockdep complains with the following lock/unlock sequence:
    
         lock_sock(sk);
         write_lock_bh(&sk->sk_callback_lock);
    [1]  release_sock(sk);
    [2]  write_unlock_bh(&sk->sk_callback_lock);
    
    We need to swap [1] and [2] to fix this issue.
    
    Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()")
    Reported-by: syzbot+bbd35b345c7cab0d9a08@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Link: https://lore.kernel.org/netdev/20230114030137.672706-1-xiyou.wangcong@xxxxxxxxx/T/#m1164ff20628671b0f326a24cb106ab3239c70ce3
    Cc: Cong Wang <cong.wang@xxxxxxxxxxxxx>
    Cc: Guillaume Nault <gnault@xxxxxxxxxx>
    Reviewed-by: Guillaume Nault <gnault@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 386510a93696..a4b793d1b7d7 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1485,10 +1485,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
 	lock_sock(sk);
 	write_lock_bh(&sk->sk_callback_lock);
 	ret = l2tp_validate_socket(sk, net, tunnel->encap);
-	if (ret < 0) {
-		release_sock(sk);
+	if (ret < 0)
 		goto err_inval_sock;
-	}
 	rcu_assign_sk_user_data(sk, tunnel);
 	write_unlock_bh(&sk->sk_callback_lock);
 
@@ -1525,6 +1523,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
 
 err_inval_sock:
 	write_unlock_bh(&sk->sk_callback_lock);
+	release_sock(sk);
 
 	if (tunnel->fd < 0)
 		sock_release(sock);