From nobody Thu Sep 4 03:31:16 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2AD2C6FA89 for ; Tue, 13 Sep 2022 15:11:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235413AbiIMPLW (ORCPT ); Tue, 13 Sep 2022 11:11:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235818AbiIMPJ1 (ORCPT ); Tue, 13 Sep 2022 11:09:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B27B7675D; Tue, 13 Sep 2022 07:32:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 13DD1614E4; Tue, 13 Sep 2022 14:30:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23E2BC433D7; Tue, 13 Sep 2022 14:30:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079409; bh=Qd9969KoNnkbTMb5ceNyswXbNKwxQESb7HfOPM1t9yI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GYcpsqFPNckEP8zb2Jb1Qdc3tRRLUcM2l9Zjza8KCHc5bV6wc6puCH54urK3wVYTX 6o3pc0EWmn4C5ZVZHnFExmlEbZDAYk3TyplzJwVUPYhk8fQsJag0VUU97RFB9kOK+2 q2BYYbBp3Pbj6i8vXBXGmrDohI6xRWeLjJRKtEzg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com, Tom Herbert , Cong Wang , Jakub Kicinski , Sasha Levin , syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.com Subject: [PATCH 4.19 15/79] kcm: fix strp_init() order and cleanup Date: Tue, 13 Sep 2022 16:06:33 +0200 Message-Id: <20220913140349.595770855@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cong Wang [ Upstream commit 8fc29ff3910f3af08a7c40a75d436b5720efe2bf ] strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away. Reported-and-tested-by: syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.c= om Reported-by: syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com Fixes: e5571240236c ("kcm: Check if sk_user_data already set in kcm_attach") Fixes: dff8baa26117 ("kcm: Call strp_stop before strp_done in kcm_attach") Cc: Tom Herbert Signed-off-by: Cong Wang Link: https://lore.kernel.org/r/20220827181314.193710-1-xiyou.wangcong@gmai= l.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/kcm/kcmsock.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index b919db02c7f9e..ef2543a4c1fc5 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct so= cket *csock, psock->sk =3D csk; psock->bpf_prog =3D prog; =20 - err =3D strp_init(&psock->strp, csk, &cb); - if (err) { - kmem_cache_free(kcm_psockp, psock); - goto out; - } - write_lock_bh(&csk->sk_callback_lock); =20 /* Check if sk_user_data is aready by KCM or someone else. @@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct s= ocket *csock, */ if (csk->sk_user_data) { write_unlock_bh(&csk->sk_callback_lock); - strp_stop(&psock->strp); - strp_done(&psock->strp); kmem_cache_free(kcm_psockp, psock); err =3D -EALREADY; goto out; } =20 + err =3D strp_init(&psock->strp, csk, &cb); + if (err) { + write_unlock_bh(&csk->sk_callback_lock); + kmem_cache_free(kcm_psockp, psock); + goto out; + } + psock->save_data_ready =3D csk->sk_data_ready; psock->save_write_space =3D csk->sk_write_space; psock->save_state_change =3D csk->sk_state_change; --=20 2.35.1