1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
linux/net/smc
Eric Dumazet 5c70eb5c59 net: better track kernel sockets lifetime
While kernel sockets are dismantled during pernet_operations->exit(),
their freeing can be delayed by any tx packets still held in qdisc
or device queues, due to skb_set_owner_w() prior calls.

This then trigger the following warning from ref_tracker_dir_exit() [1]

To fix this, make sure that kernel sockets own a reference on net->passive.

Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket
is converted to a refcounted one.

[1]

[  136.263918][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at
[  136.263918][   T35]      sk_alloc+0x2b3/0x370
[  136.263918][   T35]      inet6_create+0x6ce/0x10f0
[  136.263918][   T35]      __sock_create+0x4c0/0xa30
[  136.263918][   T35]      inet_ctl_sock_create+0xc2/0x250
[  136.263918][   T35]      igmp6_net_init+0x39/0x390
[  136.263918][   T35]      ops_init+0x31e/0x590
[  136.263918][   T35]      setup_net+0x287/0x9e0
[  136.263918][   T35]      copy_net_ns+0x33f/0x570
[  136.263918][   T35]      create_new_namespaces+0x425/0x7b0
[  136.263918][   T35]      unshare_nsproxy_namespaces+0x124/0x180
[  136.263918][   T35]      ksys_unshare+0x57d/0xa70
[  136.263918][   T35]      __x64_sys_unshare+0x38/0x40
[  136.263918][   T35]      do_syscall_64+0xf3/0x230
[  136.263918][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  136.263918][   T35]
[  136.343488][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at
[  136.343488][   T35]      sk_alloc+0x2b3/0x370
[  136.343488][   T35]      inet6_create+0x6ce/0x10f0
[  136.343488][   T35]      __sock_create+0x4c0/0xa30
[  136.343488][   T35]      inet_ctl_sock_create+0xc2/0x250
[  136.343488][   T35]      ndisc_net_init+0xa7/0x2b0
[  136.343488][   T35]      ops_init+0x31e/0x590
[  136.343488][   T35]      setup_net+0x287/0x9e0
[  136.343488][   T35]      copy_net_ns+0x33f/0x570
[  136.343488][   T35]      create_new_namespaces+0x425/0x7b0
[  136.343488][   T35]      unshare_nsproxy_namespaces+0x124/0x180
[  136.343488][   T35]      ksys_unshare+0x57d/0xa70
[  136.343488][   T35]      __x64_sys_unshare+0x38/0x40
[  136.343488][   T35]      do_syscall_64+0xf3/0x230
[  136.343488][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: 0cafd77dcd ("net: add a refcount tracker for kernel sockets")
Reported-by: syzbot+30a19e01a97420719891@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/67b72aeb.050a0220.14d86d.0283.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250220131854.4048077-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-02-21 16:00:58 -08:00
..
af_smc.c net: better track kernel sockets lifetime 2025-02-21 16:00:58 -08:00
Kconfig net/smc: introduce loopback-ism for SMC intra-OS shortcut 2024-04-30 13:24:48 +02:00
Makefile net/smc: Introduce IPPROTO_SMC 2024-06-17 13:14:09 +01:00
smc.h net/smc: Address spelling errors 2024-10-10 09:05:20 -07:00
smc_cdc.c net/smc: adapt cursor update when sndbuf and peer DMB are merged 2024-04-30 13:24:48 +02:00
smc_cdc.h net/smc: fix kernel panic caused by race of smc_sock 2021-12-28 12:42:45 +00:00
smc_clc.c net/smc: check return value of sock_recvmsg when draining clc data 2024-12-15 12:34:59 +00:00
smc_clc.h net/smc: check smcd_v2_ext_offset when receiving proposal msg 2024-12-15 12:34:59 +00:00
smc_close.c net/smc: put sk reference if close work was canceled 2023-11-06 10:01:07 +00:00
smc_close.h net/smc: remove close abort worker 2019-10-22 11:23:44 -07:00
smc_core.c net/smc: delete pointless divide by one 2025-01-11 13:08:54 -08:00
smc_core.h net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1 2024-12-12 13:50:00 +01:00
smc_diag.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-01-25 14:20:08 -08:00
smc_ib.c net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1 2024-12-12 13:50:00 +01:00
smc_ib.h net/smc: fix smc clc failed issue when netdevice not in init_net 2023-10-13 16:52:02 -07:00
smc_inet.c net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC 2024-10-10 08:48:11 -07:00
smc_inet.h net/smc: Introduce IPPROTO_SMC 2024-06-17 13:14:09 +01:00
smc_ism.c net/smc: add operations to merge sndbuf with peer DMB 2024-04-30 13:24:48 +02:00
smc_ism.h net/smc: add operations to merge sndbuf with peer DMB 2024-04-30 13:24:48 +02:00
smc_llc.c net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1 2024-12-12 13:50:00 +01:00
smc_llc.h net/smc: Introduce a specific sysctl for TEST_LINK time 2022-09-22 12:58:21 +02:00
smc_loopback.c net/smc: implement DMB-merged operations of loopback-ism 2024-04-30 13:24:49 +02:00
smc_loopback.h net/smc: remove unreferenced header in smc_loopback.h file 2024-07-31 11:48:58 +01:00
smc_netlink.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
smc_netlink.h net/smc: add support for user defined EIDs 2021-09-14 12:49:10 +01:00
smc_netns.h net/smc: introduce list of pnetids for Ethernet devices 2020-09-28 15:19:03 -07:00
smc_pnet.c net/smc: Fix lookup of netdev by using ib_device_get_netdev() 2024-11-07 11:24:19 -08:00
smc_pnet.h net/smc: Use a mutex for locking "struct smc_pnettable" 2022-02-24 09:09:33 -08:00
smc_rx.c net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-01-13 18:59:00 -08:00
smc_rx.h net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-01-13 18:59:00 -08:00
smc_stats.c net/smc: introduce statistics for ringbufs usage of net namespace 2024-08-20 11:38:23 +02:00
smc_stats.h net/smc: introduce statistics for ringbufs usage of net namespace 2024-08-20 11:38:23 +02:00
smc_sysctl.c net/smc: add sysctl for smc_limit_hs 2024-09-10 12:11:04 +02:00
smc_sysctl.h net/smc: add sysctl for max conns per lgr for SMC-R v2.1 2023-11-24 12:13:14 +00:00
smc_tracepoint.c net/smc: Introduce tracepoint for smcr link down 2021-11-01 13:39:14 +00:00
smc_tracepoint.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
smc_tx.c net/smc: remove unneeded atomic operations in smc_tx_sndbuf_nonempty 2023-11-24 15:00:47 +00:00
smc_tx.h smc: Drop smc_sendpage() in favour of smc_sendmsg() + MSG_SPLICE_PAGES 2023-06-24 15:50:12 -07:00
smc_wr.c net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1 2024-12-12 13:50:00 +01:00
smc_wr.h net/smc: Use percpu ref for wr tx reference 2023-03-17 08:59:01 +00:00