Patch "bpf: fix recursive lock when verdict program return SK_PASS" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: fix recursive lock when verdict program return SK_PASS

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-recursive-lock-when-verdict-program-return-s.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 852d11d7508550e6d3a8bc99d07ee3292af1feb2
Author: Jiayuan Chen <mrpre@xxxxxxx>
Date:   Sun Dec 29 00:44:15 2024 +0530

    bpf: fix recursive lock when verdict program return SK_PASS
    
    commit 8ca2a1eeadf09862190b2810697702d803ceef2d upstream.
    
    When the stream_verdict program returns SK_PASS, it places the received skb
    into its own receive queue, but a recursive lock eventually occurs, leading
    to an operating system deadlock. This issue has been present since v6.9.
    
    '''
    sk_psock_strp_data_ready
        write_lock_bh(&sk->sk_callback_lock)
        strp_data_ready
          strp_read_sock
            read_sock -> tcp_read_sock
              strp_recv
                cb.rcv_msg -> sk_psock_strp_read
                  # now stream_verdict return SK_PASS without peer sock assign
                  __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)
                  sk_psock_verdict_apply
                    sk_psock_skb_ingress_self
                      sk_psock_skb_ingress_enqueue
                        sk_psock_data_ready
                          read_lock_bh(&sk->sk_callback_lock) <= dead lock
    
    '''
    
    This topic has been discussed before, but it has not been fixed.
    Previous discussion:
    https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch
    
    Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue")
    Reported-by: Vincent Whitchurch <vincent.whitchurch@xxxxxxxxxxxxx>
    Signed-off-by: Jiayuan Chen <mrpre@xxxxxxx>
    Signed-off-by: John Fastabend <john.fastabend@xxxxxxxxx>
    Acked-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@xxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
    [srish: Apply to stable branch linux-5.10.y]
    Signed-off-by: Srish Srinivasan <srishwap4@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index a606ad8e8be2..dfc2e4d6a7a0 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -904,9 +904,9 @@ static void sk_psock_strp_data_ready(struct sock *sk)
 		if (tls_sw_has_ctx_rx(sk)) {
 			psock->parser.saved_data_ready(sk);
 		} else {
-			write_lock_bh(&sk->sk_callback_lock);
+			read_lock_bh(&sk->sk_callback_lock);
 			strp_data_ready(&psock->parser.strp);
-			write_unlock_bh(&sk->sk_callback_lock);
+			read_unlock_bh(&sk->sk_callback_lock);
 		}
 	}
 	rcu_read_unlock();