| From 01ea306f2ac2baff98d472da719193e738759d93 Mon Sep 17 00:00:00 2001 |
| From: Paolo Abeni <pabeni@redhat.com> |
| Date: Thu, 8 Feb 2018 12:19:00 +0100 |
| Subject: netfilter: drop outermost socket lock in getsockopt() |
| |
| From: Paolo Abeni <pabeni@redhat.com> |
| |
| commit 01ea306f2ac2baff98d472da719193e738759d93 upstream. |
| |
| The Syzbot reported a possible deadlock in the netfilter area caused by |
| rtnl lock, xt lock and socket lock being acquired with a different order |
| on different code paths, leading to the following backtrace: |
| Reviewed-by: Xin Long <lucien.xin@gmail.com> |
| |
| ====================================================== |
| WARNING: possible circular locking dependency detected |
| 4.15.0+ #301 Not tainted |
| ------------------------------------------------------ |
| syzkaller233489/4179 is trying to acquire lock: |
| (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20 |
| net/core/rtnetlink.c:74 |
| |
| but task is already holding lock: |
| (&xt[i].mutex){+.+.}, at: [<00000000328553a2>] |
| xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041 |
| |
| which lock already depends on the new lock. |
| === |
| |
| Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock |
| only in the required scope"), we already acquire the socket lock in |
| the innermost scope, where needed. In such commit I forgot to remove |
| the outer-most socket lock from the getsockopt() path, this commit |
| addresses the issues dropping it now. |
| |
| v1 -> v2: fix bad subj, added relavant 'fixes' tag |
| |
| Fixes: 22265a5c3c10 ("netfilter: xt_TEE: resolve oif using netdevice notifiers") |
| Fixes: 202f59afd441 ("netfilter: ipt_CLUSTERIP: do not hold dev") |
| Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope") |
| Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com |
| Suggested-by: Florian Westphal <fw@strlen.de> |
| Signed-off-by: Paolo Abeni <pabeni@redhat.com> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/ipv4/ip_sockglue.c | 7 +------ |
| net/ipv6/ipv6_sockglue.c | 10 ++-------- |
| 2 files changed, 3 insertions(+), 14 deletions(-) |
| |
| --- a/net/ipv4/ip_sockglue.c |
| +++ b/net/ipv4/ip_sockglue.c |
| @@ -1563,10 +1563,7 @@ int ip_getsockopt(struct sock *sk, int l |
| if (get_user(len, optlen)) |
| return -EFAULT; |
| |
| - lock_sock(sk); |
| - err = nf_getsockopt(sk, PF_INET, optname, optval, |
| - &len); |
| - release_sock(sk); |
| + err = nf_getsockopt(sk, PF_INET, optname, optval, &len); |
| if (err >= 0) |
| err = put_user(len, optlen); |
| return err; |
| @@ -1598,9 +1595,7 @@ int compat_ip_getsockopt(struct sock *sk |
| if (get_user(len, optlen)) |
| return -EFAULT; |
| |
| - lock_sock(sk); |
| err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len); |
| - release_sock(sk); |
| if (err >= 0) |
| err = put_user(len, optlen); |
| return err; |
| --- a/net/ipv6/ipv6_sockglue.c |
| +++ b/net/ipv6/ipv6_sockglue.c |
| @@ -1367,10 +1367,7 @@ int ipv6_getsockopt(struct sock *sk, int |
| if (get_user(len, optlen)) |
| return -EFAULT; |
| |
| - lock_sock(sk); |
| - err = nf_getsockopt(sk, PF_INET6, optname, optval, |
| - &len); |
| - release_sock(sk); |
| + err = nf_getsockopt(sk, PF_INET6, optname, optval, &len); |
| if (err >= 0) |
| err = put_user(len, optlen); |
| } |
| @@ -1409,10 +1406,7 @@ int compat_ipv6_getsockopt(struct sock * |
| if (get_user(len, optlen)) |
| return -EFAULT; |
| |
| - lock_sock(sk); |
| - err = compat_nf_getsockopt(sk, PF_INET6, |
| - optname, optval, &len); |
| - release_sock(sk); |
| + err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len); |
| if (err >= 0) |
| err = put_user(len, optlen); |
| } |