From: Paolo Abeni <pabeni@redhat•com>
To: Xin Long <lucien.xin@gmail•com>, network dev <netdev@vger•kernel.org>
Cc: davem@davemloft•net, chunwang@redhat•com, syzkaller@googlegroups•com
Subject: Re: [PATCH net] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt
Date: Tue, 29 Aug 2017 14:33:05 +0200 [thread overview]
Message-ID: <1504009985.7162.2.camel@redhat.com> (raw)
In-Reply-To: <4cfe77b4a829c0d6134b842fe2ea7c41b6b210ff.1503888301.git.lucien.xin@gmail.com>
On Mon, 2017-08-28 at 10:45 +0800, Xin Long wrote:
> ChunYu found a kernel warn_on during syzkaller fuzzing:
>
> [40226.038539] WARNING: CPU: 5 PID: 23720 at net/ipv4/af_inet.c:152 inet_sock_destruct+0x78d/0x9a0
> [40226.144849] Call Trace:
> [40226.147590] <IRQ>
> [40226.149859] dump_stack+0xe2/0x186
> [40226.176546] __warn+0x1a4/0x1e0
> [40226.180066] warn_slowpath_null+0x31/0x40
> [40226.184555] inet_sock_destruct+0x78d/0x9a0
> [40226.246355] __sk_destruct+0xfa/0x8c0
> [40226.290612] rcu_process_callbacks+0xaa0/0x18a0
> [40226.336816] __do_softirq+0x241/0x75e
> [40226.367758] irq_exit+0x1f6/0x220
> [40226.371458] smp_apic_timer_interrupt+0x7b/0xa0
> [40226.376507] apic_timer_interrupt+0x93/0xa0
>
> The warn_on happned when sk->sk_rmem_alloc wasn't 0 in inet_sock_destruct.
> As after commit f970bd9e3a06 ("udp: implement memory accounting helpers"),
> udp has changed to use udp_destruct_sock as sk_destruct where it would
> udp_rmem_release all rmem.
>
> But IPV6_ADDRFORM sockopt sets sk_destruct with inet_sock_destruct after
> changing family to PF_INET. If rmem is not 0 at that time, and there is
> no place to release rmem before calling inet_sock_destruct, the warn_on
> will be triggered.
>
> This patch is to fix it by not setting sk_destruct in IPV6_ADDRFORM sockopt
> any more. As IPV6_ADDRFORM sockopt only works for tcp and udp. TCP sock has
> already set it's sk_destruct with inet_sock_destruct and UDP has set with
> udp_destruct_sock since they're created.
>
> Fixes: f970bd9e3a06 ("udp: implement memory accounting helpers")
> Reported-by: ChunYu Wang <chunwang@redhat•com>
> Signed-off-by: Xin Long <lucien.xin@gmail•com>
> ---
> net/ipv6/ipv6_sockglue.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
> index 02d795f..a5e466d 100644
> --- a/net/ipv6/ipv6_sockglue.c
> +++ b/net/ipv6/ipv6_sockglue.c
> @@ -242,7 +242,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
> pktopt = xchg(&np->pktoptions, NULL);
> kfree_skb(pktopt);
>
> - sk->sk_destruct = inet_sock_destruct;
> /*
> * ... and add it to the refcnt debug socks count
> * in the new family. -acme
That assignment looks like a relic from ancient past... the patch LGTM,
Thanks Xin to fix this.
Acked-by: Paolo Abeni <pabeni@redhat•com>
next prev parent reply other threads:[~2017-08-29 12:33 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-28 2:45 [PATCH net] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt Xin Long
2017-08-29 12:33 ` Paolo Abeni [this message]
2017-08-29 17:56 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1504009985.7162.2.camel@redhat.com \
--to=pabeni@redhat$(echo .)com \
--cc=chunwang@redhat$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=lucien.xin@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=syzkaller@googlegroups$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox