From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76A0BC432BE for ; Tue, 24 Aug 2021 08:51:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4884361042 for ; Tue, 24 Aug 2021 08:51:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235419AbhHXIvq (ORCPT ); Tue, 24 Aug 2021 04:51:46 -0400 Received: from relay.sw.ru ([185.231.240.75]:51706 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234180AbhHXIvn (ORCPT ); Tue, 24 Aug 2021 04:51:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Content-Type:MIME-Version:Date:Message-ID:From: Subject; bh=9D4fyRT1vynNlON46SKzRI4rfptMAN4FO2EgEZOwqTo=; b=crv0T4XGrLJjgIFSR ePqVz4uxfjesUbSqMGznifPwgBvYgSftxJCdb7m4EQ/nf1br2lDzbeuipHjtVQEg4Lr4iLxWgkK2O 8NS5nTX4ByAzvFvjNgb0g5rfUSouyZKIHeqQ77gqL4r8PI/FogIZPE94Jjc34gc312wSmmxix8gBU =; Received: from [10.93.0.56] by relay.sw.ru with esmtp (Exim 4.94.2) (envelope-from ) id 1mIS8w-008fjA-1R; Tue, 24 Aug 2021 11:50:50 +0300 Subject: Re: [PATCH NET-NEXT] ipv6: skb_expand_head() adjust skb->truesize incorrectly To: Eric Dumazet , Christoph Paasch Cc: "David S. Miller" , Hideaki YOSHIFUJI , David Ahern , Jakub Kicinski , netdev , LKML , kernel@openvz.org, Julian Wiedmann References: <6858f130-e6b4-1ba7-ed6f-58c00152be69@virtuozzo.com> <1c12b056-79d2-126a-3f78-64629f072345@gmail.com> <2d8a102a-d641-c6c1-b417-7a35efa4e5da@gmail.com> From: Vasily Averin Message-ID: <4fe6edb4-a364-0e59-f902-9a362dd998d4@virtuozzo.com> Date: Tue, 24 Aug 2021 11:50:48 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 8/24/21 1:23 AM, Eric Dumazet wrote: > On 8/23/21 2:51 PM, Eric Dumazet wrote: >> On 8/23/21 2:45 PM, Eric Dumazet wrote: >>> On 8/23/21 10:25 AM, Christoph Paasch wrote: >>>> Hello, >>>> >>>> On Mon, Aug 23, 2021 at 12:56 AM Vasily Averin wrote: >>>>> >>>>> Christoph Paasch reports [1] about incorrect skb->truesize >>>>> after skb_expand_head() call in ip6_xmit. >>>>> This happen because skb_set_owner_w() for newly clone skb is called >>>>> too early, before pskb_expand_head() where truesize is adjusted for >>>>> (!skb-sk) case. >>>>> >>>>> [1] https://lkml.org/lkml/2021/8/20/1082 >>>>> >>>>> Reported-by: Christoph Paasch >>>>> Signed-off-by: Vasily Averin >>>>> --- >>>>> net/core/skbuff.c | 24 +++++++++++++----------- >>>>> 1 file changed, 13 insertions(+), 11 deletions(-) >>>>> >>>>> diff --git a/net/core/skbuff.c b/net/core/skbuff.c >>>>> index f931176..508d5c4 100644 >>>>> --- a/net/core/skbuff.c >>>>> +++ b/net/core/skbuff.c >>>>> @@ -1803,6 +1803,8 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, unsigned int headroom) >>>>> >>>>> struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom) >>>>> { >>>>> + struct sk_buff *oskb = skb; >>>>> + struct sk_buff *nskb = NULL; >>>>> int delta = headroom - skb_headroom(skb); >>>>> >>>>> if (WARN_ONCE(delta <= 0, >>>>> @@ -1811,21 +1813,21 @@ struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom) >>>>> >>>>> /* pskb_expand_head() might crash, if skb is shared */ >>>>> if (skb_shared(skb)) { >>>>> - struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); >>>>> - >>>>> - if (likely(nskb)) { >>>>> - if (skb->sk) >>>>> - skb_set_owner_w(nskb, skb->sk); >>>>> - consume_skb(skb); >>>>> - } else { >>>>> - kfree_skb(skb); >>>>> - } >>>>> + nskb = skb_clone(skb, GFP_ATOMIC); >>>>> skb = nskb; >>>>> } >>>>> if (skb && >>>>> - pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { >>>>> - kfree_skb(skb); >>>>> + pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) >>>>> skb = NULL; >>>>> + >>>>> + if (!skb) { >>>>> + kfree_skb(oskb); >>>>> + if (nskb) >>>>> + kfree_skb(nskb); >>>>> + } else if (nskb) { >>>>> + if (oskb->sk) >>>>> + skb_set_owner_w(nskb, oskb->sk); >>>>> + consume_skb(oskb); >>>> >>>> sorry, this does not fix the problem. The syzkaller repro still >>>> triggers the WARN. >>>> >>>> When it happens, the skb in ip6_xmit() is not shared as it comes from >>>> __tcp_transmit_skb, where it is skb_clone()'d. >>>> >>>> >>> >>> Old code (in skb_realloc_headroom()) >>> was first calling skb2 = skb_clone(skb, GFP_ATOMIC); >>> >>> At this point, skb2->sk was NULL >>> So pskb_expand_head(skb2, SKB_DATA_ALIGN(delta), 0, ...) was able to tweak skb2->truesize >>> >>> I would try : >>> >>> diff --git a/net/core/skbuff.c b/net/core/skbuff.c >>> index f9311762cc475bd38d87c33e988d7c983b902e56..326749a8938637b044a616cc33b6a19ed191ac41 100644 >>> --- a/net/core/skbuff.c >>> +++ b/net/core/skbuff.c >>> @@ -1804,6 +1804,7 @@ EXPORT_SYMBOL(skb_realloc_headroom); >>> struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom) >>> { >>> int delta = headroom - skb_headroom(skb); >>> + struct sk_buff *oskb = NULL; >>> >>> if (WARN_ONCE(delta <= 0, >>> "%s is expecting an increase in the headroom", __func__)) >>> @@ -1813,19 +1814,21 @@ struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom) >>> if (skb_shared(skb)) { >>> struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); >>> >>> - if (likely(nskb)) { >>> - if (skb->sk) >>> - skb_set_owner_w(nskb, skb->sk); >>> - consume_skb(skb); >>> - } else { >>> + if (unlikely(!nskb)) { >>> kfree_skb(skb); >>> + return NULL; >>> } >>> + oskb = skb; >>> skb = nskb; >>> } >>> - if (skb && >>> - pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { >>> + if (pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { >>> kfree_skb(skb); >>> - skb = NULL; >>> + kfree_skb(oskb); >>> + return NULL; >>> + } >>> + if (oskb) { >>> + skb_set_owner_w(skb, oskb->sk); >>> + consume_skb(oskb); >>> } >>> return skb; >>> } >> >> >> Oh well, probably not going to work. >> >> We have to find a way to properly increase skb->truesize, even if skb_clone() is _not_ called. Can we adjust truesize outside pskb_expand_head()? Could you please explain why it can be not safe? > I also note that current use of skb_set_owner_w(), forcing skb->destructor to sock_wfree() > is probably breaking TCP Small queues, since original skb->destructor would be tcp_wfree() or __sock_wfree() I agree, however as far as I understand it is separate and more global problem. Thank you, Vasily Averin