[PATCH net v2] strparser: make sure __strp_recv isn't running before tearing down the parser

The comment above strp_done() claims that if strp is stopped,
strp_recv will no longer be called. That's only true if the caller has
a mechanism (eg locking) to guarantee that strp_recv() calls that
started before strp_stop() have completed by the time we call
strp_done().

This adds a lock_sock/release_sock pair to guarantee that any
in-flight strp_recv() (which runs under either bh_lock_sock or
lock_sock, depending if it's called from ->sk_data_ready or strp_work)
has completed.

Only espintcp can be affected by this race condition, but this patch
makes sure no future user of strp can have the bug.

This could crash on strp->sk ("general mode" of strp), but this mode
has been here for 9 years and has never been used.

Reported-by: Hyunwoo Kim <redacted>
Link: https://lore.kernel.org/all/aZgpkyTDU3aXe_V0@v4bel/ (local)
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Cc: stable@vger.kernel.org
Reviewed-by: Hyunwoo Kim <redacted>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
---
v2: no code change, just add Cc: stable and Reviewed-by: tags
v1: https://lore.kernel.org/all/4c80ea646f95abbd5beca2c081d129fe7d61a0aa.1790344112.git.sd@queasysnail.net (local)

 net/strparser/strparser.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index a23f4b4dfc67..401e67533005 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c

@@ -511,6 +511,10 @@ void strp_done(struct strparser *strp)
 {
 	WARN_ON(!strp->stopped);
 
+	lock_sock(strp->sk);
+	/* sync with pending strp_recv */
+	release_sock(strp->sk);
+
 	cancel_delayed_work_sync(&strp->msg_timer_work);
 	cancel_work_sync(&strp->work);
 

-- 
2.55.0