Patch "netfilter: ipset: Fix for recursive locking warning" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: ipset: Fix for recursive locking warning

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-ipset-fix-for-recursive-locking-warning.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 66e9b3635f67d80f1dbb7267f726d853d21d6e3a
Author: Phil Sutter <phil@xxxxxx>
Date:   Tue Dec 17 20:56:55 2024 +0100

    netfilter: ipset: Fix for recursive locking warning
    
    [ Upstream commit 70b6f46a4ed8bd56c85ffff22df91e20e8c85e33 ]
    
    With CONFIG_PROVE_LOCKING, when creating a set of type bitmap:ip, adding
    it to a set of type list:set and populating it from iptables SET target
    triggers a kernel warning:
    
    | WARNING: possible recursive locking detected
    | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
    | --------------------------------------------
    | ping/4018 is trying to acquire lock:
    | ffff8881094a6848 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set]
    |
    | but task is already holding lock:
    | ffff88811034c048 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set]
    
    This is a false alarm: ipset does not allow nested list:set type, so the
    loop in list_set_kadd() can never encounter the outer set itself. No
    other set type supports embedded sets, so this is the only case to
    consider.
    
    To avoid the false report, create a distinct lock class for list:set
    type ipset locks.
    
    Fixes: f830837f0eed ("netfilter: ipset: list:set set type support")
    Signed-off-by: Phil Sutter <phil@xxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index c4aae8c586ac..b8b4beb2073e 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -611,6 +611,8 @@ init_list_set(struct net *net, struct ip_set *set, u32 size)
 	return true;
 }
 
+static struct lock_class_key list_set_lockdep_key;
+
 static int
 list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
 		u32 flags)
@@ -627,6 +629,7 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
 	if (size < IP_SET_LIST_MIN_SIZE)
 		size = IP_SET_LIST_MIN_SIZE;
 
+	lockdep_set_class(&set->lock, &list_set_lockdep_key);
 	set->variant = &set_variant;
 	set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem),
 				     __alignof__(struct set_elem));