Re: [PATCH] nbd: fix circular lock dependency

[Guilherme Giacomo Simoes <trintaeoitogc@gmail.com>]

Hillf Danton <hdanton@sina.com> wrote:
> FYI reclassifying sockets is also corrupting memory [11], so can you fix
> the corrupter before reclassifying again?
> 
> [11] Subject: [syzbot] BUG: spinlock already unlocked in corrupted
> https://lore.kernel.org/lkml/6aec63fd.5f5735a5.290c1c.0003.GAE@google.com/
Important thing to do.

I'm not a nbd/net specialist, I only get the "fix possible circular dependency"
bug to resolve because this appears in mm subsystem syzbot.
But, I read this bug and see that is a race condition between inet_shutdown()
and sock_allow_reclassification().

How IA analysis say:
"""
- Thread 1 (runner/shutdown) calls inet_shutdown() -> release_sock(sk). Inside
 release_sock(), Thread 1 acquires spin_lock_bh(&sk->sk_lock.slock).

- Thread 2 (reclassifier) enters nbd_add_socket() ->
 nbd_reclassify_socket(sock). Right before Thread 1 acquired the lock,
 sock_allow_reclassification(sk) returned true. Thread 2 calls
 sock_lock_init_class_and_name(), which invokes
 spin_lock_init(&sk->sk_lock.slock) while Thread 1 is holding slock.

- spin_lock_init() zeroes the spinlock and marks it unlocked
 (SPINLOCK_OWNER_INIT).

- Thread 1 finishes processing in release_sock() and calls
 spin_unlock_bh(&sk->sk_lock.slock).
 ... 
"""

What lead me think that when Thread 1 try acquire lock this would must be
blocked to acquire this lock, so a spin_lock(&sk->sk_lock.slock) inside
nbd_reclassify_socker right bellow sock_allow_reclassification(sk) fix this
bug?

```
static void nbd_reclassify_socket(struct socket *sock)
{
	struct sock *sk = sock->sk;

	if (!sock_allow_reclassification(sk))
		return;

	spin_lock(&sk->sk_lock.slock);

    ...
```

thanks,
guilherme