CVE-2021-47242

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix soft lookup in subflow_error_report()

Maxim reported a soft lookup in subflow_error_report():

watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:0]

RIP: 0010:native_queued_spin_lock_slowpath

RSP: 0018:ffffa859c0003bc0 EFLAGS: 00000202

RAX: 0000000000000101 RBX: 0000000000000001 RCX: 0000000000000000

RDX: ffff9195c2772d88 RSI: 0000000000000000 RDI: ffff9195c2772d88

RBP: ffff9195c2772d00 R08: 00000000000067b0 R09: c6e31da9eb1e44f4

R10: ffff9195ef379700 R11: ffff9195edb50710 R12: ffff9195c2772d88

R13: ffff9195f500e3d0 R14: ffff9195ef379700 R15: ffff9195ef379700

FS: 0000000000000000(0000) GS:ffff91961f400000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000c000407000 CR3: 0000000002988000 CR4: 00000000000006f0

Call Trace:

<IRQ>

_raw_spin_lock_bh

subflow_error_report

mptcp_subflow_data_available

__mptcp_move_skbs_from_subflow

mptcp_data_ready

tcp_data_queue

tcp_rcv_established

tcp_v4_do_rcv

tcp_v4_rcv

ip_protocol_deliver_rcu

ip_local_deliver_finish

__netif_receive_skb_one_core

netif_receive_skb

rtl8139_poll 8139too

__napi_poll

net_rx_action

__do_softirq

__irq_exit_rcu

common_interrupt

</IRQ>

The calling function - mptcp_subflow_data_available() - can be invoked

from different contexts:

- plain ssk socket lock

- ssk socket lock + mptcp_data_lock

- ssk socket lock + mptcp_data_lock + msk socket lock.

Since subflow_error_report() tries to acquire the mptcp_data_lock, the

latter two call chains will cause soft lookup.

This change addresses the issue moving the error reporting call to

outer functions, where the held locks list is known and the we can

acquire only the needed one.