From: Kuniyuki Iwashima <kuniyu@amazon.com>
To: <kuniyu@amazon.com>
Cc: <christophpaasch@icloud.com>, <davem@davemloft.net>,
<edumazet@google.com>, <kuba@kernel.org>, <kuni1840@gmail.com>,
<matthieu.baerts@tessares.net>, <netdev@vger.kernel.org>,
<pabeni@redhat.com>, <syzkaller@googlegroups.com>
Subject: Re: [PATCH v1 net] net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
Date: Tue, 7 Feb 2023 16:42:45 -0800 [thread overview]
Message-ID: <20230208004245.83497-1-kuniyu@amazon.com> (raw)
In-Reply-To: <20230208003713.83105-1-kuniyu@amazon.com>
From: Kuniyuki Iwashima <kuniyu@amazon.com>
Date: Tue, 7 Feb 2023 16:37:13 -0800
> From: Eric Dumazet <edumazet@google.com>
> Date: Tue, 7 Feb 2023 20:25:19 +0100
> > On Tue, Feb 7, 2023 at 7:37 PM Kuniyuki Iwashima <kuniyu@amazon.com> wrote:
> > >
> > > In commit b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in
> > > sk->sk_prot->destroy()."), we delay freeing some IPv6 resources
> > > from sk->destroy() to sk->sk_destruct().
> > >
> > > Christoph Paasch reported the commit started triggering
> > > WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues()
> > > (See [0 - 2]).
> > >
> > > For example, if inet6_sk(sk)->rxopt is not zero by setting
> > > IPV6_RECVPKTINFO or its friends, tcp_v6_do_rcv() clones a skb
> > > and calls skb_set_owner_r(), which charges it to sk.
> >
> > skb_set_owner_r() in this place seems wrong.
> > This could lead to a negative sk->sk_forward_alloc
> > (because we have not sk_rmem_schedule() it ?)
> >
> > Do you have a repro ?
>
> I created a repro and confirmed sk->sk_forward_alloc was always positive.
>
> ---8<---
Sorry, I missed unistd.h here while copy-and-paste.
#include <unistd.h>
> #include <stdio.h>
>
> #include <sys/socket.h>
> #include <netinet/in.h>
>
> #define IPV6_FLOWINFO 11
>
> int main(void)
> {
> struct sockaddr_in6 addr = {
> .sin6_family = AF_INET6,
> .sin6_addr = in6addr_any,
> .sin6_port = htons(0),
> };
> int fd, ret = 0;
> socklen_t len;
>
> ret = socket(AF_INET6, SOCK_STREAM, IPPROTO_IP);
> perror("socket");
> if (ret < 0)
> return ret;
>
> fd = ret;
> ret = setsockopt(fd, SOL_IPV6, IPV6_FLOWINFO, &(int){1}, sizeof(int));
> perror("setsockopt");
>
> ret = bind(fd, (struct sockaddr *)&addr, sizeof(addr));
> perror("bind");
> if (ret)
> goto out;
>
> len = sizeof(addr);
> ret = getsockname(fd, (struct sockaddr *)&addr, &len);
> perror("getsockname");
> if (ret)
> goto out;
>
> ret = connect(fd, (struct sockaddr *)&addr, len);
> perror("connect");
> if (ret)
> goto out;
>
> out:
> close(fd);
>
> return ret;
> }
> ---8<---
next prev parent reply other threads:[~2023-02-08 0:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-07 18:37 [PATCH v1 net] net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues() Kuniyuki Iwashima
2023-02-07 19:25 ` Eric Dumazet
2023-02-07 21:37 ` Kuniyuki Iwashima
2023-02-08 0:37 ` Kuniyuki Iwashima
2023-02-08 0:42 ` Kuniyuki Iwashima [this message]
2023-02-08 1:01 ` Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230208004245.83497-1-kuniyu@amazon.com \
--to=kuniyu@amazon.com \
--cc=christophpaasch@icloud.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=kuni1840@gmail.com \
--cc=matthieu.baerts@tessares.net \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).