lkml.org 
[lkml]   [2021]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH net] rxrpc: Fix deadlock around release of dst cached on udp tunnel
From
Date
On 29.01.2021 17:30, Vadim Fedorenko wrote:
> On 29.01.2021 16:44, David Howells wrote:
>> AF_RXRPC sockets use UDP ports in encap mode.  This causes socket and dst
>> from an incoming packet to get stolen and attached to the UDP socket from
>> whence it is leaked when that socket is closed.
>>
>> When a network namespace is removed, the wait for dst records to be cleaned
>> up happens before the cleanup of the rxrpc and UDP socket, meaning that the
>> wait never finishes.
>>
>> Fix this by moving the rxrpc (and, by dependence, the afs) private
>> per-network namespace registrations to the device group rather than subsys
>> group.  This allows cached rxrpc local endpoints to be cleared and their
>> UDP sockets closed before we try waiting for the dst records.
>>
>> The symptom is that lines looking like the following:
>>
>>     unregister_netdevice: waiting for lo to become free
>>
>> get emitted at regular intervals after running something like the
>> referenced syzbot test.
>>
>> Thanks to Vadim for tracking this down and work out the fix.
>
> You missed the call to dst_release(sk->sk_rx_dst) in rxrpc_sock_destructor.
> Without it we are still leaking the dst.
I mean this part:

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 0a2f481..3c0635e 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -833,6 +833,7 @@ static void rxrpc_sock_destructor(struct sock *sk)
_enter("%p", sk);

rxrpc_purge_queue(&sk->sk_receive_queue);
+ dst_destroy(sk->sk_rx_dst);

WARN_ON(refcount_read(&sk->sk_wmem_alloc));
WARN_ON(!sk_unhashed(sk));
\
 
 \ /
  Last update: 2021-01-29 18:42    [W:0.067 / U:0.332 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site