Re: [PATCH net] net, sk_msg: Don't check if sock is locked when tearing down psock

On 1/21/20 1:31 PM, Jakub Sitnicki wrote:

As John Fastabend reports [0], psock state tear-down can happen on receive
path *after* unlocking the socket, if the only other psock user, that is
sockmap or sockhash, releases its psock reference before tcp_bpf_recvmsg
does so:

  tcp_bpf_recvmsg()
   psock = sk_psock_get(sk)                         <- refcnt 2
   lock_sock(sk);
   ...
                                   sock_map_free()  <- refcnt 1
   release_sock(sk)
   sk_psock_put()                                   <- refcnt 0

Remove the lockdep check for socket lock in psock tear-down that got
introduced in 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during
tear down").

[0] https://lore.kernel.org/netdev/5e25dc995d7d_74082aaee6e465b441@john-XPS-13-9370.notmuch/ (local)

Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down")
Reported-by: syzbot+d73682fcf7fee6982fe3@syzkaller.appspotmail.com
Suggested-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>

Given it's assigned to you right now, David, feel free to take directly to net:

Acked-by: Daniel Borkmann <daniel@iogearbox.net>

Thanks,
Daniel