From: Sasha Levin <sashal@kernel•org>
To: linux-kernel@vger•kernel.org, stable@vger•kernel.org
Cc: Stefan Hajnoczi <stefanha@redhat•com>,
Graham Whaley <graham.whaley@gmail•com>,
"Michael S . Tsirkin" <mst@redhat•com>,
Sasha Levin <sashal@kernel•org>,
kvm@vger•kernel.org, virtualization@lists•linux-foundation.org,
netdev@vger•kernel.org
Subject: [PATCH AUTOSEL 4.9 30/34] vhost/vsock: fix reset orphans race with close timeout
Date: Wed, 12 Dec 2018 23:31:56 -0500 [thread overview]
Message-ID: <20181213043200.76295-30-sashal@kernel.org> (raw)
In-Reply-To: <20181213043200.76295-1-sashal@kernel.org>
From: Stefan Hajnoczi <stefanha@redhat•com>
[ Upstream commit c38f57da428b033f2721b611d84b1f40bde674a8 ]
If a local process has closed a connected socket and hasn't received a
RST packet yet, then the socket remains in the table until a timeout
expires.
When a vhost_vsock instance is released with the timeout still pending,
the socket is never freed because vhost_vsock has already set the
SOCK_DONE flag.
Check if the close timer is pending and let it close the socket. This
prevents the race which can leak sockets.
Reported-by: Maximilian Riemensberger <riemensberger@cadami•net>
Cc: Graham Whaley <graham.whaley@gmail•com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat•com>
Signed-off-by: Michael S. Tsirkin <mst@redhat•com>
Signed-off-by: Sasha Levin <sashal@kernel•org>
---
drivers/vhost/vsock.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 0ec970ca64ce..5d77a7491edb 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -551,13 +551,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
* executing.
*/
- if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
- sock_set_flag(sk, SOCK_DONE);
- vsk->peer_shutdown = SHUTDOWN_MASK;
- sk->sk_state = SS_UNCONNECTED;
- sk->sk_err = ECONNRESET;
- sk->sk_error_report(sk);
- }
+ /* If the peer is still valid, no need to reset connection */
+ if (vhost_vsock_get(vsk->remote_addr.svm_cid))
+ return;
+
+ /* If the close timeout is pending, let it expire. This avoids races
+ * with the timeout callback.
+ */
+ if (vsk->close_work_scheduled)
+ return;
+
+ sock_set_flag(sk, SOCK_DONE);
+ vsk->peer_shutdown = SHUTDOWN_MASK;
+ sk->sk_state = SS_UNCONNECTED;
+ sk->sk_err = ECONNRESET;
+ sk->sk_error_report(sk);
}
static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
--
2.19.1
next prev parent reply other threads:[~2018-12-13 4:31 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-13 4:31 [PATCH AUTOSEL 4.9 01/34] mac80211_hwsim: fix module init error paths for netlink Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 07/34] bonding: fix 802.3ad state sent to partner when unbinding slave Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 09/34] SUNRPC: Fix leak of krb5p encode pages Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 10/34] SUNRPC: Fix a potential race in xprt_connect() Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 19/34] net: phy: don't allow __set_phy_supported to add unsupported modes Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 20/34] net: 8139cp: fix a BUG triggered by changing mtu with network traffic Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 21/34] net: phy: Fix not to call phy_resume() if PHY is not attached Sasha Levin
2018-12-13 4:50 ` Yoshihiro Shimoda
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 22/34] mv88e6060: disable hardware level MAC learning Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 23/34] net/mlx4_en: Fix build break when CONFIG_INET is off Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 24/34] bpf: check pending signals while verifying programs Sasha Levin
2018-12-13 4:31 ` [PATCH AUTOSEL 4.9 27/34] ethernet: fman: fix wrong of_node_put() in probe function Sasha Levin
2018-12-13 4:31 ` Sasha Levin [this message]
2018-12-13 4:32 ` [PATCH AUTOSEL 4.9 34/34] net/mlx4_core: Correctly set PFC param if global pause is turned off Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181213043200.76295-30-sashal@kernel.org \
--to=sashal@kernel$(echo .)org \
--cc=graham.whaley@gmail$(echo .)com \
--cc=kvm@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=mst@redhat$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=stable@vger$(echo .)kernel.org \
--cc=stefanha@redhat$(echo .)com \
--cc=virtualization@lists$(echo .)linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox