Eric Dumazet
44e62f5d35
tcp: properly terminate timers for kernel sockets ...
[ Upstream commit 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada ]
We had various syzbot reports about tcp timers firing after
the corresponding netns has been dismantled.
Fortunately Josef Bacik could trigger the issue more often,
and could test a patch I wrote two years ago.
When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
to 'stop' the timers.
inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer().
This means that ongoing timers might finish much later.
For user sockets, this is fine because each running timer
holds a reference on the socket, and the user socket holds
a reference on the netns.
For kernel sockets, we risk that the netns is freed before
timer can complete, because kernel sockets do not hold
reference on the netns.
This patch adds inet_csk_clear_xmit_timers_sync() function
that using sk_stop_timer_sync() to make sure all timers
are terminated before the kernel socket is released.
Modules using kernel sockets close them in their netns exit()
handler.
Also add sock_not_owned_by_me() helper to get LOCKDEP
support : inet_csk_clear_xmit_timers_sync() must not be called
while socket lock is held.
It is very possible we can revert in the future commit
3a58f13a881e ("net: rds: acquire refcount on TCP sockets")
which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)
We probably can remove the check_net() tests from
tcp_out_of_resources() and __tcp_close() in the future.
Reported-by: Josef Bacik <josef@toxicpanda.com>
Closes: https://lore.kernel.org/netdev/20240314210740.GA2823176@perftesting/
Fixes: 26abe143798a68173691https://lore.kernel.org/bpf/CANn89i+484ffqb93aQm1N-tjxxvb3WDKX0EbD7318RwRgsatjw@mail.gmail.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Josef Bacik <josef@toxicpanda.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/20240322135732.1535772-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-13 12:51:33 +02:00
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
2024-01-25 14:34:26 -08:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
2024-02-23 08:25:15 +01:00
ipv6: make ip6_rt_gc_expire an atomic_t
2024-01-15 18:25:29 +01:00
nfc: constify several pointers to u8, char and sk_buff
2023-07-27 08:37:07 +02:00
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
2023-03-11 16:44:11 +01:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
2023-12-20 15:41:13 +01:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
af_unix: fix lockdep positive in sk_diag_dump_icons()
2024-02-23 08:25:05 +01:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
2023-06-14 10:59:58 +02:00
bonding: fix macvlan over alb bond support
2023-08-30 16:27:24 +02:00
net: Fix a data-race around sysctl_net_busy_poll.
2022-09-05 10:27:42 +02:00
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
2023-08-16 18:19:24 +02:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
2020-05-27 17:46:24 +02:00
net: Remove unused inline function dst_hold_and_use()
2023-06-21 15:44:12 +02:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
ipv6: remove max_size check inline with ipv4
2024-01-15 18:25:29 +01:00
esp: limit skb_page_frag_refill use to a single page
2022-07-12 16:30:45 +02:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
inet: shrink struct flowi_common
2023-11-20 10:30:15 +01:00
net/sched: flower: fix parsing of ethertype following VLAN header
2022-04-20 09:19:34 +02:00
drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
2023-12-13 18:18:17 +01:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:22:59 +02:00
net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
2023-12-20 15:41:13 +01:00
tcp: properly terminate timers for kernel sockets
2024-04-13 12:51:33 +02:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
2022-07-29 17:14:11 +02:00
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
2023-06-05 08:17:33 +02:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
2023-05-30 12:44:05 +01:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
ip_tunnels: use DEV_STATS_INC()
2023-09-23 10:59:59 +02:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:16:10 +02:00
tcp: Reduce chance of collisions in inet6_hashfn().
2023-08-11 11:53:47 +02:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
bonding/alb: properly access headers in bond_alb_xmit()
2020-02-11 04:35:48 -08:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
llc: Drop support for ETH_P_TR_802_2.
2024-02-23 08:24:50 +01:00
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
2023-09-23 10:59:42 +02:00
mac80211: populate debugfs only after cfg80211 init
2020-04-29 16:33:18 +02:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
neighbour: delete neigh_lookup_nodev as not used
2023-06-21 15:44:12 +02:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net/sched: make psched_mtu() RTNL-less safe
2023-07-27 08:37:33 +02:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 20:59:22 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
net: validate veth and vxcan peer ifindexes
2023-08-30 16:27:24 +02:00
net/sched: sch_taprio: fix possible use-after-free
2023-02-06 07:52:37 +01:00
scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
2023-05-17 11:35:41 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp: properly terminate timers for kernel sockets
2024-04-13 12:51:33 +02:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
tcp: factor out __tcp_close() helper
2024-03-01 13:13:34 +01:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
vxlan: calculate correct header length for GPE
2023-08-11 11:53:47 +02:00
xfrm: Check if_id in xfrm_migrate
2022-03-19 13:40:16 +01:00
44e62f5d35