From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
To: netdev@vger.kernel.org
Cc: ebiederm@xmission.com, davem@davemloft.net, sowmini.varadhan@oracle.com
Subject: netns refcnt leak for kernel accept sock
Date: Mon, 27 Jul 2015 16:21:46 +0200 [thread overview]
Message-ID: <20150727142146.GC16447@oracle.com> (raw)
I'm running into a netns refcnt issue, and I suspect that
eeb1bd5c has something to do with it (perhaps we need an
additional change in sk_clone_lock() after eeb1bd5c).
Here's the problem:
When we create an syn_recv sock based on a kernel listen sock, we
take a get_net() ref with a stack similar to the one shown below.
Note that the parent (kernel, listen) sock itself has not taken
a get_net() ref, because it explicitly calls sock_create_kern().
get_net /* for the newsk */
sk_clone_lock
inet_csk_clone_lock
tcp_create_openreq_child
tcp_v4_syn_recv_sock
tcp_check_req
tcp_v4_do_rcv
tcp_v4_rcv
:
But it's not clear to me where this refcnt will be released:
in my case, I expect to create/cleanup kernel sockets as part
of ->init/->exit for my module, but because the accept socket
has a netns refcnt, it blocks cleanup_net(), thus my ->exit
pernet_subsys op cannot run and clean this up, and we have a leak.
I think that sk_clone_lock() should only do a get_net() if the parent
is not a kernel socket (making this similar to sk_alloc()), i.e.,
diff --git a/net/core/sock.c b/net/core/sock.c
index 08f16db..371d1b7 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1497,7 +1497,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gf
sock_copy(newsk, sk);
/* SANITY */
- get_net(sock_net(newsk));
+ if (likely(newsk->sk_net_refcnt))
+ get_net(sock_net(newsk));
sk_node_init(&newsk->sk_node);
sock_lock_init(newsk);
bh_lock_sock(newsk);
Does this sound right?
--Sowmini
next reply other threads:[~2015-07-27 14:21 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-27 14:21 Sowmini Varadhan [this message]
2015-07-27 17:40 ` netns refcnt leak for kernel accept sock Eric W. Biederman
2015-07-27 17:57 ` Sowmini Varadhan
2015-07-27 18:13 ` Cong Wang
2015-07-27 18:19 ` Sowmini Varadhan
2015-07-27 18:37 ` Cong Wang
2015-07-27 18:50 ` Sowmini Varadhan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150727142146.GC16447@oracle.com \
--to=sowmini.varadhan@oracle.com \
--cc=davem@davemloft.net \
--cc=ebiederm@xmission.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).