From: Eric Dumazet <eduma...@google.com>
Date: Mon, 1 Oct 2018 15:02:26 -0700
> In normal SYN processing, packets are handled without listener
> lock and in RCU protected ingress path.
>
> But syzkaller is known to be able to trick us and SYN
> packets might be processed in process context, after being
> queued into socket backlog.
>
> In commit 06f877d613be ("tcp/dccp: fix other lockdep splats
> accessing ireq_opt") I made a very stupid fix, that happened
> to work mostly because of the regular path being RCU protected.
>
> Really the thing protecting ireq->ireq_opt is RCU read lock,
> and the pseudo request refcnt is not relevant.
>
> This patch extends what I did in commit 449809a66c1d ("tcp/dccp:
> block BH for SYN processing") by adding an extra rcu_read_{lock|unlock}
> pair in the paths that might be taken when processing SYN from
> socket backlog (thus possibly in process context)
>
> Fixes: 06f877d613be ("tcp/dccp: fix other lockdep splats accessing ireq_opt")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
Applied and queued up for -stable, thanks Eric.
