[PATCH net] l2tp: prevent lockdep issue in l2tp_tunnel_register()

[PATCH net] l2tp: prevent lockdep issue in l2tp_tunnel_register()

[Eric Dumazet]

lockdep complains with the following lock/unlock sequence:

     lock_sock(sk);
     write_lock_bh(&sk->sk_callback_lock);
[1]  release_sock(sk);
[2]  write_unlock_bh(&sk->sk_callback_lock);

We need to swap [1] and [2] to fix this issue.

Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()")
Reported-by: syzbot+bbd35b345c7cab0d9a08@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/netdev/20230114030137.672706-1-xiyou.wangcong@gmail.com/T/#m1164ff20628671b0f326a24cb106ab3239c70ce3
Cc: Cong Wang <cong.wang@bytedance.com>
Cc: Guillaume Nault <gnault@redhat.com>
---
 net/l2tp/l2tp_core.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index b6554e32bb12ae7813cc06c01e4d1380af667375..03608d3ded4b83d1e59e064e482f54cffcdf5240 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1483,10 +1483,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
 	lock_sock(sk);
 	write_lock_bh(&sk->sk_callback_lock);
 	ret = l2tp_validate_socket(sk, net, tunnel->encap);
-	if (ret < 0) {
-		release_sock(sk);
+	if (ret < 0)
 		goto err_inval_sock;
-	}
 	rcu_assign_sk_user_data(sk, tunnel);
 	write_unlock_bh(&sk->sk_callback_lock);
 
@@ -1523,6 +1521,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
 
 err_inval_sock:
 	write_unlock_bh(&sk->sk_callback_lock);
+	release_sock(sk);
 
 	if (tunnel->fd < 0)
 		sock_release(sock);
-- 
2.39.0.314.g84b9a713c41-goog

Re: [PATCH net] l2tp: prevent lockdep issue in l2tp_tunnel_register()

[Guillaume Nault]

On Tue, Jan 17, 2023 at 11:01:31AM +0000, Eric Dumazet wrote:
> lockdep complains with the following lock/unlock sequence:
> 
>      lock_sock(sk);
>      write_lock_bh(&sk->sk_callback_lock);
> [1]  release_sock(sk);
> [2]  write_unlock_bh(&sk->sk_callback_lock);
> 
> We need to swap [1] and [2] to fix this issue.

Reviewed-by: Guillaume Nault <gnault@redhat.com>

Re: [PATCH net] l2tp: prevent lockdep issue in l2tp_tunnel_register()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Tue, 17 Jan 2023 11:01:31 +0000 you wrote:
> lockdep complains with the following lock/unlock sequence:
> 
>      lock_sock(sk);
>      write_lock_bh(&sk->sk_callback_lock);
> [1]  release_sock(sk);
> [2]  write_unlock_bh(&sk->sk_callback_lock);
> 
> [...]

Here is the summary with links:
  - [net] l2tp: prevent lockdep issue in l2tp_tunnel_register()
    https://git.kernel.org/netdev/net/c/b9fb10d131b8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net] l2tp: prevent lockdep issue in l2tp_tunnel_register()

[Cong Wang]

On Tue, Jan 17, 2023 at 11:01:31AM +0000, Eric Dumazet wrote:
> lockdep complains with the following lock/unlock sequence:
> 
>      lock_sock(sk);
>      write_lock_bh(&sk->sk_callback_lock);
> [1]  release_sock(sk);
> [2]  write_unlock_bh(&sk->sk_callback_lock);
> 
> We need to swap [1] and [2] to fix this issue.
> 
> Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()")
> Reported-by: syzbot+bbd35b345c7cab0d9a08@syzkaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Link: https://lore.kernel.org/netdev/20230114030137.672706-1-xiyou.wangcong@gmail.com/T/#m1164ff20628671b0f326a24cb106ab3239c70ce3
> Cc: Cong Wang <cong.wang@bytedance.com>
> Cc: Guillaume Nault <gnault@redhat.com>

Oops, my bad.

Acked-by: Cong Wang <cong.wang@bytedance.com>

Thanks.