[Devel] [PATCH RHEL7 COMMIT] ms/netfilter: drop outermost socket lock in getsockopt()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-862.11.6.vz7.64.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-862.11.6.vz7.64.5
------>
commit c9fe7d34ad46a0b3d6d5464636484bdabe80e736
Author: Paolo Abeni <pabeni at redhat.com>
Date:   Mon Aug 20 17:14:08 2018 +0300

    ms/netfilter: drop outermost socket lock in getsockopt()
    
    ML commit: 01ea306f2ac2baff98d472da719193e738759d93
    
    The Syzbot reported a possible deadlock in the netfilter area caused by
    rtnl lock, xt lock and socket lock being acquired with a different order
    on different code paths, leading to the following backtrace:
    Reviewed-by: Xin Long <lucien.xin at gmail.com>
    
    ======================================================
    WARNING: possible circular locking dependency detected
    4.15.0+ #301 Not tainted
    but task is already holding lock:
      (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]
    xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041
    
    which lock already depends on the new lock.
    ===
    
    Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock
    only in the required scope"), we already acquire the socket lock in
    the innermost scope, where needed. In such commit I forgot to remove
    the outer-most socket lock from the getsockopt() path, this commit
    addresses the issues dropping it now.
    
    v1 -> v2: fix bad subj, added relavant 'fixes' tag
    
    Fixes: 22265a5c3c10 ("netfilter: xt_TEE: resolve oif using netdevice notifiers")
    Fixes: 202f59afd441 ("netfilter: ipt_CLUSTERIP: do not hold dev")
    Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope")
    Reported-by: syzbot+ddde1c7b7ff7442d7f2d at syzkaller.appspotmail.com
    Suggested-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Paolo Abeni <pabeni at redhat.com>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    
    https://jira.sw.ru/browse/PSBM-87858
    
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 net/ipv4/ip_sockglue.c   |  7 +------
 net/ipv6/ipv6_sockglue.c | 10 ++--------
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 15fc6148f7f6..3954875b51ce 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1454,10 +1454,7 @@ int ip_getsockopt(struct sock *sk, int level,
 		if (!ve_ipt_permitted(net, VE_IP_FILTER))
 			return -ENOENT;
 
-		lock_sock(sk);
-		err = nf_getsockopt(sk, PF_INET, optname, optval,
-				&len);
-		release_sock(sk);
+		err = nf_getsockopt(sk, PF_INET, optname, optval, &len);
 		if (err >= 0)
 			err = put_user(len, optlen);
 		return err;
@@ -1489,9 +1486,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
 		if (get_user(len, optlen))
 			return -EFAULT;
 
-		lock_sock(sk);
 		err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len);
-		release_sock(sk);
 		if (err >= 0)
 			err = put_user(len, optlen);
 		return err;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 7ed1035a6135..c44ea63570c9 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -1299,10 +1299,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
 		if (get_user(len, optlen))
 			return -EFAULT;
 
-		lock_sock(sk);
-		err = nf_getsockopt(sk, PF_INET6, optname, optval,
-				&len);
-		release_sock(sk);
+		err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
 		if (err >= 0)
 			err = put_user(len, optlen);
 	}
@@ -1342,10 +1339,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
 		if (get_user(len, optlen))
 			return -EFAULT;
 
-		lock_sock(sk);
-		err = compat_nf_getsockopt(sk, PF_INET6,
-					   optname, optval, &len);
-		release_sock(sk);
+		err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len);
 		if (err >= 0)
 			err = put_user(len, optlen);
 	}