| Message ID | 20240212143402.23181-1-dmantipov@yandex.ru (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 6cf9ff463317217d95732a6cce6fbdd12508921a |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: smc: fix spurious error message from __sock_release() | expand |
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Mon, 12 Feb 2024 17:34:02 +0300 you wrote: > Commit 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback") > leaves the socket's fasync list pointer within a container socket as well. > When the latter is destroyed, '__sock_release()' warns about its non-empty > fasync list, which is a dangling pointer to previously freed fasync list > of an underlying TCP socket. Fix this spurious warning by nullifying > fasync list of a container socket. > > [...] Here is the summary with links: - net: smc: fix spurious error message from __sock_release() https://git.kernel.org/netdev/net/c/6cf9ff463317 You are awesome, thank you!
On 12.02.24 15:34, Dmitry Antipov wrote: > Commit 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback") > leaves the socket's fasync list pointer within a container socket as well. > When the latter is destroyed, '__sock_release()' warns about its non-empty > fasync list, which is a dangling pointer to previously freed fasync list > of an underlying TCP socket. Fix this spurious warning by nullifying > fasync list of a container socket. > > Fixes: 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback") > Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> I see my antwort is too late... But I still want to send out my comments: - please check current MAINTAINERS to put all of the related person in your recipient list. - It looks reasonable to me. I'm curious how you got the warning. By using ULP, right? Thanks, Wenjia > --- > net/smc/af_smc.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c > index a2cb30af46cb..0f53a5c6fd9d 100644 > --- a/net/smc/af_smc.c > +++ b/net/smc/af_smc.c > @@ -924,6 +924,7 @@ static int smc_switch_to_fallback(struct smc_sock *smc, int reason_code) > smc->clcsock->file->private_data = smc->clcsock; > smc->clcsock->wq.fasync_list = > smc->sk.sk_socket->wq.fasync_list; > + smc->sk.sk_socket->wq.fasync_list = NULL; > > /* There might be some wait entries remaining > * in smc sk->sk_wq and they should be woken up
On 2/14/24 18:09, Wenjia Zhang wrote:
> - It looks reasonable to me. I'm curious how you got the warning. By using ULP, right?
This was tracked down from https://syzkaller.appspot.com/bug?extid=5f1acda7e06a2298fae6,
and unfortunately it doesn't fix an actual leak of 'struct fasync_struct' objects. I'm
suspecting an undefined behavior caused by the race condition somewhere around socket
impersonation tricks in 'smc_switch_to_fallback()', and it would be very helpful if an
original authors can take a look as well.
Dmitry
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index a2cb30af46cb..0f53a5c6fd9d 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -924,6 +924,7 @@ static int smc_switch_to_fallback(struct smc_sock *smc, int reason_code) smc->clcsock->file->private_data = smc->clcsock; smc->clcsock->wq.fasync_list = smc->sk.sk_socket->wq.fasync_list; + smc->sk.sk_socket->wq.fasync_list = NULL; /* There might be some wait entries remaining * in smc sk->sk_wq and they should be woken up
Commit 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback") leaves the socket's fasync list pointer within a container socket as well. When the latter is destroyed, '__sock_release()' warns about its non-empty fasync list, which is a dangling pointer to previously freed fasync list of an underlying TCP socket. Fix this spurious warning by nullifying fasync list of a container socket. Fixes: 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- net/smc/af_smc.c | 1 + 1 file changed, 1 insertion(+)