From: Eric Dumazet <eduma...@google.com> Date: Mon, 1 Oct 2018 15:02:26 -0700
> In normal SYN processing, packets are handled without listener > lock and in RCU protected ingress path. > > But syzkaller is known to be able to trick us and SYN > packets might be processed in process context, after being > queued into socket backlog. > > In commit 06f877d613be ("tcp/dccp: fix other lockdep splats > accessing ireq_opt") I made a very stupid fix, that happened > to work mostly because of the regular path being RCU protected. > > Really the thing protecting ireq->ireq_opt is RCU read lock, > and the pseudo request refcnt is not relevant. > > This patch extends what I did in commit 449809a66c1d ("tcp/dccp: > block BH for SYN processing") by adding an extra rcu_read_{lock|unlock} > pair in the paths that might be taken when processing SYN from > socket backlog (thus possibly in process context) > > Fixes: 06f877d613be ("tcp/dccp: fix other lockdep splats accessing ireq_opt") > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: syzbot <syzkal...@googlegroups.com> Applied and queued up for -stable, thanks Eric.