tcp: fix possible deadlock in TCP stack vs BPF filter (d624d276) · Commits · 戴 / test

Filtering the ACK packet was not put at the right place. At this place, we already allocated a child and put it into accept queue. We absolutely need to call tcp_child_process() to release its spinlock, or we will deadlock at accept() or close() time. Found by syzkaller team (Thanks a lot !) Fixes: ("tcp: Add a tcp_filter hook before handle ack packet") Signed-off-by:

Eric Dumazet <edumazet@google.com> Reported-by:

Dmitry Vyukov <dvyukov@google.com> Cc: Chenbo Feng <fengc@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp_ipv4.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1722,6 +1722,8 @@ process:
		*/
		sock_hold(sk);
		refcounted = true;
		if (tcp_filter(sk, skb))
		goto discard_and_relse;
		nsk = tcp_check_req(sk, skb, req, false);
		if (!nsk) {
		reqsk_put(req);
		@@ -1729,8 +1731,6 @@ process:
		}
		if (nsk == sk) {
		reqsk_put(req);
		} else if (tcp_filter(sk, skb)) {
		goto discard_and_relse;
		} else if (tcp_child_process(sk, nsk, skb)) {
		tcp_v4_send_reset(nsk, skb);
		goto discard_and_relse;

net/ipv6/tcp_ipv6.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1456,6 +1456,8 @@ process:
		}
		sock_hold(sk);
		refcounted = true;
		if (tcp_filter(sk, skb))
		goto discard_and_relse;
		nsk = tcp_check_req(sk, skb, req, false);
		if (!nsk) {
		reqsk_put(req);
		@@ -1464,8 +1466,6 @@ process:
		if (nsk == sk) {
		reqsk_put(req);
		tcp_v6_restore_cb(skb);
		} else if (tcp_filter(sk, skb)) {
		goto discard_and_relse;
		} else if (tcp_child_process(sk, nsk, skb)) {
		tcp_v6_send_reset(nsk, skb);
		goto discard_and_relse;

Admin message