From patchwork Fri May 17 09:27:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Luczaj X-Patchwork-Id: 13666798 X-Patchwork-Delegate: kuba@kernel.org Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA72722324 for ; Fri, 17 May 2024 09:32:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715938330; cv=none; b=R+JtcqBcwDqMBwXFglI8wwaKYRj7BsfG+8DNh8YoR5KKeNIDbxhn318oupbGHiaanK4/1qgmufgKivdjYf1WaUyHy8vSw4vJjEPr/uMFK/BhTZzicM54GIjv/wGNulTWnJJf+KWNupgH86EahFujPIZkB8jukEoEasMZnY7UwOU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715938330; c=relaxed/simple; bh=kXzSCaoHprIm7lNjKNUMgvG3ZWiIZOpe+OGbnRBrq5E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k4F905smPLR7UlNqGzHrawjCiSYqJZb0UeA4rpmjLvJWsTb+S5cKx0sGAuNI1s0Y0UfYFTdHOVOub1NTL2k4OhndaZUPb5XRH4+t1gl4tthLOrNvHecvOlMbjoE88FAuKbvBWcrHV7V2iI3wizQs9iTgqMI3uqwsUleBizfwLf8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=Dwvx0H+d; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="Dwvx0H+d" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1s7twa-005L3x-HT; Fri, 17 May 2024 11:32:04 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:Cc:To:From; bh=yokzBYS17hWADW2KY3nlMvcWNr12nOM5EuszZJW34Xw=; b=Dwvx0H+dAnU1WYspSfgAi9j/kw bcWbACXXEIWvdEaPnjzzIEA84Thty2gZQ5c8ktXZV7GU5ESHOxaYelyQOEJZTzPOxS2x9Ra/yOxpD ipCp4vnQDP3H5gZZPRQh035m+K5gY3Q1kjM96kakA8I+L4qpwWmKb7Q5RnwAVb6WhrJ5Oxn1CAVep eqmhMwEp0CnOEi49rs8vy8zEXPqYFJuX+8i69F29uM7jxTSfyTjSJD2eDt7XmstXPloc6QzX2aNqx ahnwtkXKN8RZMgtNeGaaIAj9WwSWsXlB5LmO172OWxjUcb0xAh+gTmXjQL5/6R3zU1ZdCPE+l5qbQ GVIeI/RQ==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1s7twV-0000b4-5E; Fri, 17 May 2024 11:31:59 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.93) id 1s7twQ-0042Jz-2t; Fri, 17 May 2024 11:31:54 +0200 From: Michal Luczaj To: netdev@vger.kernel.org Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, kuniyu@amazon.com, shuah@kernel.org, Michal Luczaj Subject: [PATCH v3 net 1/2] af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS Date: Fri, 17 May 2024 11:27:01 +0200 Message-ID: <20240517093138.1436323-2-mhal@rbox.co> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20240517093138.1436323-1-mhal@rbox.co> References: <20240517093138.1436323-1-mhal@rbox.co> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org GC attempts to explicitly drop oob_skb's reference before purging the hit list. The problem is with embryos: kfree_skb(u->oob_skb) is never called on an embryo socket. The python script below [0] sends a listener's fd to its embryo as OOB data. While GC does collect the embryo's queue, it fails to drop the OOB skb's refcount. The skb which was in embryo's receive queue stays as unix_sk(sk)->oob_skb and keeps the listener's refcount [1]. Tell GC to dispose embryo's oob_skb. [0]: from array import array from socket import * addr = '\x00unix-oob' lis = socket(AF_UNIX, SOCK_STREAM) lis.bind(addr) lis.listen(1) s = socket(AF_UNIX, SOCK_STREAM) s.connect(addr) scm = (SOL_SOCKET, SCM_RIGHTS, array('i', [lis.fileno()])) s.sendmsg([b'x'], [scm], MSG_OOB) lis.close() [1] $ grep unix-oob /proc/net/unix $ ./unix-oob.py $ grep unix-oob /proc/net/unix 0000000000000000: 00000002 00000000 00000000 0001 02 0 @unix-oob 0000000000000000: 00000002 00000000 00010000 0001 01 6072 @unix-oob Fixes: 4090fa373f0e ("af_unix: Replace garbage collection algorithm.") Signed-off-by: Michal Luczaj Reviewed-by: Kuniyuki Iwashima --- net/unix/garbage.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/net/unix/garbage.c b/net/unix/garbage.c index 1f8b8cdfcdc8..dfe94a90ece4 100644 --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -342,6 +342,18 @@ enum unix_recv_queue_lock_class { U_RECVQ_LOCK_EMBRYO, }; +static void unix_collect_queue(struct unix_sock *u, struct sk_buff_head *hitlist) +{ + skb_queue_splice_init(&u->sk.sk_receive_queue, hitlist); + +#if IS_ENABLED(CONFIG_AF_UNIX_OOB) + if (u->oob_skb) { + WARN_ON_ONCE(skb_unref(u->oob_skb)); + u->oob_skb = NULL; + } +#endif +} + static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist) { struct unix_vertex *vertex; @@ -365,18 +377,11 @@ static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist /* listener -> embryo order, the inversion never happens. */ spin_lock_nested(&embryo_queue->lock, U_RECVQ_LOCK_EMBRYO); - skb_queue_splice_init(embryo_queue, hitlist); + unix_collect_queue(unix_sk(skb->sk), hitlist); spin_unlock(&embryo_queue->lock); } } else { - skb_queue_splice_init(queue, hitlist); - -#if IS_ENABLED(CONFIG_AF_UNIX_OOB) - if (u->oob_skb) { - kfree_skb(u->oob_skb); - u->oob_skb = NULL; - } -#endif + unix_collect_queue(u, hitlist); } spin_unlock(&queue->lock); From patchwork Fri May 17 09:27:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Luczaj X-Patchwork-Id: 13666797 X-Patchwork-Delegate: kuba@kernel.org Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8AD3C20B02 for ; Fri, 17 May 2024 09:32:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715938330; cv=none; b=oJT6CGHpDj0AyTSR0IKDKMjevx5Vz2lV0yOub4pD1A3DdKxZurAXnwMFBsZ9jNgW6QWBJcpTJlOa7t/Tk6ixCf32xUQmAdsaVYGbUaciPmNNWhCiPGKamskdPGZ1lRThOzAu12hcVK2DkI5EDcHLZgREoEDJu0OpXZe5ntTOAcQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715938330; c=relaxed/simple; bh=pLvfs2wkuPdWUKvnQbF+as0kuqbXNTuPzoK72qeAdQM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mK5St/fLoM/3S0MfoINJulKt4PyiZy8rKaEAhUxQYQwKPmHZPJPPv5dD+/J/3SIJLd07thZHTf7ZIV9beirCC43egFhPyKBQtZZhtxPig83bMk8a9Viu5SjIu5Gk5eV7YTUOlRmjrAbvHf9S2ksd01TYk8VkHm+cp4LYHc1EuEk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=o/Rff7Tf; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="o/Rff7Tf" Received: from mailtransmit03.runbox ([10.9.9.163] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1s7twW-005L3q-9k; Fri, 17 May 2024 11:32:00 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:Cc:To:From; bh=GktP9RrtK0vi05fOjnT9zi0SQ8iuCCBEsFoEskXI23U=; b=o/Rff7TfwisIau/2rbG4RQC+9u NFqMhK1GiYxLc3bfVwkF0bqX0tVDp0FjUF0JUb7hyxdA62+oVDtQ6bh68/RhR8pKTwuAaLRLHuSNt Qvyxmr09vO2NrWT0wCjUAWqnkhN+q/ZDmHBg315lKJuR2LJb25c2owtWK0Kk9qnF2PwfGxqRZ4s/g Q2Uh6eDew0cgeWBo0NDxigSBM5HIffYokIq5NcY74arqMYRHK1VXnJSr1E93jDhHN0wesK88pcKi/ CZJh3etkt1KnbfXNHFosZx47n3Sf/Euf6oeFWPPxiFofhXIns4nriExChIVwQ14JUPGJH7dtkGRSn RyswGCIg==; Received: from [10.9.9.74] (helo=submission03.runbox) by mailtransmit03.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1s7twV-0002B1-IS; Fri, 17 May 2024 11:31:59 +0200 Received: by submission03.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.93) id 1s7twQ-0042Jz-IF; Fri, 17 May 2024 11:31:54 +0200 From: Michal Luczaj To: netdev@vger.kernel.org Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, kuniyu@amazon.com, shuah@kernel.org Subject: [PATCH v3 net 2/2] selftest: af_unix: Make SCM_RIGHTS into OOB data. Date: Fri, 17 May 2024 11:27:02 +0200 Message-ID: <20240517093138.1436323-3-mhal@rbox.co> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20240517093138.1436323-1-mhal@rbox.co> References: <20240517093138.1436323-1-mhal@rbox.co> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org From: Kuniyuki Iwashima scm_rights.c covers various test cases for inflight file descriptors and garbage collector for AF_UNIX sockets. Currently, SCM_RIGHTS messages are sent with 3-bytes string, and it's not good for MSG_OOB cases, as SCM_RIGTS cmsg goes with the first 2-bytes, which is non-OOB data. Let's send SCM_RIGHTS messages with 1-byte character to pack SCM_RIGHTS into OOB data. Signed-off-by: Kuniyuki Iwashima Signed-off-by: Michal Luczaj --- tools/testing/selftests/net/af_unix/scm_rights.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/af_unix/scm_rights.c b/tools/testing/selftests/net/af_unix/scm_rights.c index bab606c9f1eb..2bfed46e0b19 100644 --- a/tools/testing/selftests/net/af_unix/scm_rights.c +++ b/tools/testing/selftests/net/af_unix/scm_rights.c @@ -197,8 +197,8 @@ void __send_fd(struct __test_metadata *_metadata, const FIXTURE_VARIANT(scm_rights) *variant, int inflight, int receiver) { -#define MSG "nop" -#define MSGLEN 3 +#define MSG "x" +#define MSGLEN 1 struct { struct cmsghdr cmsghdr; int fd[2];