1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
linux/net/rds
Eric Dumazet 5c70eb5c59 net: better track kernel sockets lifetime
While kernel sockets are dismantled during pernet_operations->exit(),
their freeing can be delayed by any tx packets still held in qdisc
or device queues, due to skb_set_owner_w() prior calls.

This then trigger the following warning from ref_tracker_dir_exit() [1]

To fix this, make sure that kernel sockets own a reference on net->passive.

Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket
is converted to a refcounted one.

[1]

[  136.263918][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at
[  136.263918][   T35]      sk_alloc+0x2b3/0x370
[  136.263918][   T35]      inet6_create+0x6ce/0x10f0
[  136.263918][   T35]      __sock_create+0x4c0/0xa30
[  136.263918][   T35]      inet_ctl_sock_create+0xc2/0x250
[  136.263918][   T35]      igmp6_net_init+0x39/0x390
[  136.263918][   T35]      ops_init+0x31e/0x590
[  136.263918][   T35]      setup_net+0x287/0x9e0
[  136.263918][   T35]      copy_net_ns+0x33f/0x570
[  136.263918][   T35]      create_new_namespaces+0x425/0x7b0
[  136.263918][   T35]      unshare_nsproxy_namespaces+0x124/0x180
[  136.263918][   T35]      ksys_unshare+0x57d/0xa70
[  136.263918][   T35]      __x64_sys_unshare+0x38/0x40
[  136.263918][   T35]      do_syscall_64+0xf3/0x230
[  136.263918][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  136.263918][   T35]
[  136.343488][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at
[  136.343488][   T35]      sk_alloc+0x2b3/0x370
[  136.343488][   T35]      inet6_create+0x6ce/0x10f0
[  136.343488][   T35]      __sock_create+0x4c0/0xa30
[  136.343488][   T35]      inet_ctl_sock_create+0xc2/0x250
[  136.343488][   T35]      ndisc_net_init+0xa7/0x2b0
[  136.343488][   T35]      ops_init+0x31e/0x590
[  136.343488][   T35]      setup_net+0x287/0x9e0
[  136.343488][   T35]      copy_net_ns+0x33f/0x570
[  136.343488][   T35]      create_new_namespaces+0x425/0x7b0
[  136.343488][   T35]      unshare_nsproxy_namespaces+0x124/0x180
[  136.343488][   T35]      ksys_unshare+0x57d/0xa70
[  136.343488][   T35]      __x64_sys_unshare+0x38/0x40
[  136.343488][   T35]      do_syscall_64+0xf3/0x230
[  136.343488][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 0cafd77dcd ("net: add a refcount tracker for kernel sockets")
Reported-by: syzbot+30a19e01a97420719891@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/67b72aeb.050a0220.14d86d.0283.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250220131854.4048077-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-02-21 16:00:58 -08:00
..
af_rds.c net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv 2024-01-22 11:24:00 +00:00
bind.c treewide: use get_random_{u8,u16}() when possible, part 2 2022-10-11 17:42:58 -06:00
cong.c net: rds: delete duplicated words 2020-09-18 14:12:43 -07:00
connection.c net: rds: Simplify the allocation of slab caches in rds_conn_init 2024-01-30 17:08:19 -08:00
ib.c RDMA: Split kernel-only global device caps from uverbs device caps 2022-04-06 15:02:13 -03:00
ib.h RDS: IB: Remove unused declarations 2024-08-01 09:03:28 -07:00
ib_cm.c rds: ib: Remove two ib_modify_qp() calls 2021-04-12 19:51:48 -03:00
ib_frmr.c net/rds: dma_map_sg is entitled to merge entries 2021-08-18 15:35:50 -07:00
ib_mr.h RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
ib_rdma.c net/rds: remove unused struct 'rds_ib_dereg_odp_mr' 2024-10-03 16:42:52 -07:00
ib_recv.c net: add missing includes of linux/sched/clock.h 2023-01-27 11:19:46 +00:00
ib_ring.c rds: Fix spelling mistakes 2021-05-31 22:45:05 -07:00
ib_send.c rds: Remove redundant assignment to nr_sig 2021-04-27 14:14:33 -07:00
ib_stats.c net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' 2019-09-15 20:56:19 +02:00
ib_sysctl.c net: rds: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
info.c rds: fix crash in rds_info_getsockopt() 2020-05-20 14:08:06 -07:00
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig net: rds: add option for GCOV profiling 2024-08-09 13:18:46 +01:00
loop.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
loop.h rds: clean up loopback rds_connections on netns deletion 2018-06-27 10:11:03 +09:00
Makefile net: rds: add option for GCOV profiling 2024-08-09 13:18:46 +01:00
message.c rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-02-13 09:33:39 +00:00
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma.c net/rds: fix possible cp null dereference 2024-03-29 12:04:09 -07:00
rdma_transport.c net: rds: Fix possible NULL-pointer dereference 2023-09-20 08:49:03 +01:00
rdma_transport.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rds.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
recv.c net:rds: Fix possible deadlock in rds_message_put 2024-02-13 10:25:30 +01:00
send.c rds: introduce acquire/release ordering in acquire/release_in_xmit() 2024-03-19 12:15:35 +01:00
stats.c rds: check for excessive looping in rds_send_xmit 2019-08-15 12:04:24 -07:00
sysctl.c net: rds: Remove the now superfluous sentinel elements from ctl_table array 2024-05-03 13:29:42 +01:00
tcp.c net: better track kernel sockets lifetime 2025-02-21 16:00:58 -08:00
tcp.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
tcp_connect.c net: prevent address rewrite in kernel_bind() 2023-10-01 19:31:29 +01:00
tcp_listen.c net: change proto and proto_ops accept type 2024-05-13 18:19:09 -06:00
tcp_recv.c rds:Simplify the allocation of slab caches 2024-06-19 10:47:40 +01:00
tcp_send.c rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage 2023-06-24 15:50:12 -07:00
tcp_stats.c net: rds: fix const array syntax 2011-07-01 16:16:19 -07:00
threads.c rds: Fix fall-through warnings for Clang 2021-05-17 20:00:27 -05:00
transport.c rds: transport module should be auto loaded when transport is set 2020-06-25 16:26:25 -07:00