• Paolo Abeni's avatar
    netfilter: drop outermost socket lock in getsockopt() · 01ea306f
    Paolo Abeni authored
    The Syzbot reported a possible deadlock in the netfilter area caused by
    rtnl lock, xt lock and socket lock being acquired with a different order
    on different code paths, leading to the following backtrace:
    Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
    
    ======================================================
    WARNING: possible circular locking dependency detected
    4.15.0+ #301 Not tainted
    ------------------------------------------------------
    syzkaller233489/4179 is trying to acquire lock:
      (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20
    net/core/rtnetlink.c:74
    
    but task is already holding lock:
      (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]
    xt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041
    
    which lock already depends on the new lock.
    ===
    
    Since commit 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock
    only in the required scope"), we already acquire the socket lock in
    the innermost scope, where needed. In such commit I forgot to remove
    the outer-most socket lock from the getsockopt() path, this commit
    addresses the issues dropping it now.
    
    v1 -> v2: fix bad subj, added relavant 'fixes' tag
    
    Fixes: 22265a5c ("netfilter: xt_TEE: resolve oif using netdevice notifiers")
    Fixes: 202f59af ("netfilter: ipt_CLUSTERIP: do not hold dev")
    Fixes: 3f34cfae1230 ("netfilter: on sockopt() acquire sock lock only in the required scope")
    Reported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com
    Suggested-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    01ea306f
ipv6_sockglue.c 30.1 KB