From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225upJFT7D80w0Bom9W2tbvtEQM3fZVmFv+iBnnHrOk+NmpBKp8rWpiUhZdlCazwEnmV/YGL ARC-Seal: i=1; a=rsa-sha256; t=1517256256; cv=none; d=google.com; s=arc-20160816; b=KpV2Jkbi/bnPb7EdeK6ctfJRXYcfFl8BF/pqqFFQ7pSgpK4psGgYANxhqaTBANPHIx Jkl/C5mNj3KJm8PxNPpnbmJ9KmMbpdckkQdIchXuUW3KYlUGspXwcRRoqv3ycWJOjf66 GAvgNU7eFpzH7FKRw1RZvrshhjwBVqwNuWfM1ZXTC2CSaT14DaRJhgivqCQ4WvMF0GOP LSo9utNurByv+QXo9HFVRrWzWMiIaTHpJ4+HhUdw7JGuR0/6KwJ9WLBEhC8hVxJ3hteb XWk+SUvX8+EGZUwtLA1nK9BVGZ4mLNKCnrTMAgR2+6toS9JrPynDth3vg6jPn8nUa+6Z z3mQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=bqfH/RlcUtuXQ7c3HX0Rby/iS/q4zbXqKlkO+gSGEEI=; b=KlBkAoFFilx9MEkixgOW1eyh/gVrZ9iXbe++X3UNsLQjhpLFEubEXCHSCbT2gu4VQo 0HsiEXvPSE5tLRy+LLO7Uv+bxKrTZV6sr/Qoosn6ftcxbiwYFLWHVSD2nsBLDXq8B1pQ mGVFqPxz8xdpi8tSe6LrPk9CQqVkJrbbr+DHQ+BVuUWZwgC8T7nOpgWiMqD+zxH7B1ij H2Ayc9MIRvQ1vSvFM8rSFJQEB9F8VYwsk7dDqagX+BJ1t2C6Rz1MtP1XyKMHB+O2gsT4 Xl5B+QsnbOSMUttQarYdHfPwhy+9p9tJ5SKjogiwR7nhe9WKvJaO5iw9x82LXvpWHLRc oqIw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Streetman , "David S. Miller" Subject: [PATCH 4.9 40/66] net: tcp: close sock if net namespace is exiting Date: Mon, 29 Jan 2018 13:57:04 +0100 Message-Id: <20180129123842.008068988@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123839.842860149@linuxfoundation.org> References: <20180129123839.842860149@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958487171947539?= X-GMAIL-MSGID: =?utf-8?q?1590958496235267476?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Streetman [ Upstream commit 4ee806d51176ba7b8ff1efd81f271d7252e03a1d ] When a tcp socket is closed, if it detects that its net namespace is exiting, close immediately and do not wait for FIN sequence. For normal sockets, a reference is taken to their net namespace, so it will never exit while the socket is open. However, kernel sockets do not take a reference to their net namespace, so it may begin exiting while the kernel socket is still open. In this case if the kernel socket is a tcp socket, it will stay open trying to complete its close sequence. The sock's dst(s) hold a reference to their interface, which are all transferred to the namespace's loopback interface when the real interfaces are taken down. When the namespace tries to take down its loopback interface, it hangs waiting for all references to the loopback interface to release, which results in messages like: unregister_netdevice: waiting for lo to become free. Usage count = 1 These messages continue until the socket finally times out and closes. Since the net namespace cleanup holds the net_mutex while calling its registered pernet callbacks, any new net namespace initialization is blocked until the current net namespace finishes exiting. After this change, the tcp socket notices the exiting net namespace, and closes immediately, releasing its dst(s) and their reference to the loopback interface, which lets the net namespace continue exiting. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1711407 Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=97811 Signed-off-by: Dan Streetman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/net_namespace.h | 10 ++++++++++ net/ipv4/tcp.c | 3 +++ net/ipv4/tcp_timer.c | 15 +++++++++++++++ 3 files changed, 28 insertions(+) --- a/include/net/net_namespace.h +++ b/include/net/net_namespace.h @@ -213,6 +213,11 @@ int net_eq(const struct net *net1, const return net1 == net2; } +static inline int check_net(const struct net *net) +{ + return atomic_read(&net->count) != 0; +} + void net_drop_ns(void *); #else @@ -236,6 +241,11 @@ int net_eq(const struct net *net1, const { return 1; } + +static inline int check_net(const struct net *net) +{ + return 1; +} #define net_drop_ns NULL #endif --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2215,6 +2215,9 @@ adjudge_to_death: tcp_send_active_reset(sk, GFP_ATOMIC); __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY); + } else if (!check_net(sock_net(sk))) { + /* Not possible to send reset; just close */ + tcp_set_state(sk, TCP_CLOSE); } } --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -50,11 +50,19 @@ static void tcp_write_err(struct sock *s * to prevent DoS attacks. It is called when a retransmission timeout * or zero probe timeout occurs on orphaned socket. * + * Also close if our net namespace is exiting; in that case there is no + * hope of ever communicating again since all netns interfaces are already + * down (or about to be down), and we need to release our dst references, + * which have been moved to the netns loopback interface, so the namespace + * can finish exiting. This condition is only possible if we are a kernel + * socket, as those do not hold references to the namespace. + * * Criteria is still not confirmed experimentally and may change. * We kill the socket, if: * 1. If number of orphaned sockets exceeds an administratively configured * limit. * 2. If we have strong memory pressure. + * 3. If our net namespace is exiting. */ static int tcp_out_of_resources(struct sock *sk, bool do_reset) { @@ -83,6 +91,13 @@ static int tcp_out_of_resources(struct s __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY); return 1; } + + if (!check_net(sock_net(sk))) { + /* Not possible to send reset; just close */ + tcp_done(sk); + return 1; + } + return 0; }