mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-28 21:33:52 +00:00
Code Issues Releases Wiki Activity
linux-stable/include/net
History
Eric Dumazet e3e27d2b44 tcp: properly terminate timers for kernel sockets 
[ Upstream commit 151c9c724d ]

We had various syzbot reports about tcp timers firing after
the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often,
and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
to 'stop' the timers.

inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer().
This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer
holds a reference on the socket, and the user socket holds
a reference on the netns.

For kernel sockets, we risk that the netns is freed before
timer can complete, because kernel sockets do not hold
reference on the netns.

This patch adds inet_csk_clear_xmit_timers_sync() function
that using sk_stop_timer_sync() to make sure all timers
are terminated before the kernel socket is released.
Modules using kernel sockets close them in their netns exit()
handler.

Also add sock_not_owned_by_me() helper to get LOCKDEP
support : inet_csk_clear_xmit_timers_sync() must not be called
while socket lock is held.

It is very possible we can revert in the future commit
3a58f13a88 ("net: rds: acquire refcount on TCP sockets")
which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)

We probably can remove the check_net() tests from
tcp_out_of_resources() and __tcp_close() in the future.

Reported-by: Josef Bacik <josef@toxicpanda.com>
Closes: https://lore.kernel.org/netdev/20240314210740.GA2823176@perftesting/
Fixes: 26abe14379 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")
Fixes: 8a68173691 ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket")
Link: https://lore.kernel.org/bpf/CANn89i+484ffqb93aQm1N-tjxxvb3WDKX0EbD7318RwRgsatjw@mail.gmail.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Josef Bacik <josef@toxicpanda.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/20240322135732.1535772-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-04-13 12:59:15 +02:00
..
9p net: 9p: drop duplicate word in comment 2020-07-15 20:34:11 -07:00
bluetooth Bluetooth: Fix bogus check for re-auth no supported with non-ssp 2024-01-25 14:37:46 -08:00
caif net: caif: add proper error handling 2021-06-10 13:39:24 +02:00
iucv net/af_iucv: clean up function prototypes 2020-05-19 12:50:14 -07:00
netfilter netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() 2024-02-23 08:42:32 +01:00
netns xfrm: fix a data-race in xfrm_gen_index() 2023-10-25 11:54:19 +02:00
nfc nfc: constify several pointers to u8, char and sk_buff 2023-07-27 08:43:37 +02:00
phonet
sctp sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop 2023-03-11 16:40:12 +01:00
tc_act net/sched: act_pedit: really ensure the skb is writable 2022-05-18 10:23:44 +02:00
6lowpan.h
act_api.h net: sched: fix err handler in tcf_action_init() 2021-04-14 08:42:05 +02:00
addrconf.h net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX 2023-12-20 15:44:27 +01:00
af_ieee802154.h
af_rxrpc.h rxrpc: Make rxrpc_kernel_get_srtt() indicate validity 2020-08-20 18:21:28 +01:00
af_unix.h af_unix: fix lockdep positive in sk_diag_dump_icons() 2024-02-23 08:42:17 +01:00
af_vsock.h vsock: each transport cycles only on its own sockets 2022-03-23 09:13:27 +01:00
ah.h
arp.h ipv4: Invalidate neighbour for broadcast address upon address addition 2022-04-13 21:00:57 +02:00
atmclip.h
ax25.h ax25: fix reference count leaks of ax25_dev 2022-04-20 09:23:31 +02:00
ax88796.h
bareudp.h bareudp: Reverted support to enable & disable rx metadata collection 2020-07-21 18:30:47 -07:00
bond_3ad.h net: bonding: Share lacpdu_mcast_addr definition 2022-09-28 11:10:31 +02:00
bond_alb.h bonding (gcc13): synchronize bond_{a,t}lb_xmit() types 2023-06-14 11:09:31 +02:00
bond_options.h
bonding.h bonding: fix macvlan over alb bond support 2023-08-30 16:23:14 +02:00
bpf_sk_storage.h bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON 2020-09-25 13:58:01 -07:00
busy_poll.h net: Fix a data-race around sysctl_net_busy_poll. 2022-08-31 17:15:20 +02:00
calipso.h
cfg80211-wext.h
cfg80211.h wifi: cfg80211: fix sband iftype data lookup for AP_VLAN 2023-08-16 18:21:02 +02:00
cfg802154.h mac802154: fix llsec key resources release in mac802154_llsec_key_del 2024-04-13 12:58:25 +02:00
checksum.h net: Force inlining of checksum functions in net/checksum.h 2022-03-02 11:42:50 +01:00
cipso_ipv4.h cipso: Remove unused inline functions 2020-07-15 07:45:24 -07:00
cls_cgroup.h
codel.h
codel_impl.h
codel_qdisc.h
compat.h net/ipv4/ipv6: Replace one-element arraya with flexible-array members 2024-03-26 18:21:53 -04:00
datalink.h
dcbevent.h
dcbnl.h
devlink.h devlink: Add enable_remote_dev_reset generic parameter 2020-10-09 12:06:53 -07:00
dsa.h net: dsa: propagate switchdev vlan_filtering prepare phase to drivers 2020-10-05 05:56:48 -07:00
dsfield.h
dst.h net: Remove unused inline function dst_hold_and_use() 2023-06-21 15:45:40 +02:00
dst_cache.h wireguard: device: reset peer src endpoint when netns exits 2021-12-08 09:03:22 +01:00
dst_metadata.h net: fix a memleak when uncloning an skb dst and its metadata 2022-02-16 12:54:26 +01:00
dst_ops.h ipv6: remove max_size check inline with ipv4 2024-01-15 18:48:07 +01:00
erspan.h erspan: Add type I version 0 support. 2020-05-05 13:23:29 -07:00
esp.h esp: limit skb_page_frag_refill use to a single page 2022-04-27 13:53:48 +02:00
espintcp.h xfrm: espintcp: save and call old ->sk_destruct 2020-04-20 07:34:16 +02:00
ethoc.h
failover.h
fib_notifier.h
fib_rules.h ipv6: fix memory leak in fib6_rule_suppress 2021-12-08 09:03:21 +01:00
firewire.h
flow.h inet: shrink struct flowi_common 2023-11-20 11:06:55 +01:00
flow_dissector.h net/sched: flower: fix parsing of ethertype following VLAN header 2022-04-20 09:23:11 +02:00
flow_offload.h netfilter: nf_tables: bail out early if hardware offload is not supported 2022-06-14 18:32:40 +02:00
fou.h
fq.h net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb 2020-07-31 09:24:24 +02:00
fq_impl.h net/fq_impl: use skb_get_hash instead of skb_get_hash_perturb 2020-07-31 09:24:24 +02:00
garp.h
gen_stats.h
genetlink.h drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group 2023-12-13 18:27:06 +01:00
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h GUE: Fix a typo 2020-06-22 21:12:44 -07:00
hwbm.h
icmp.h net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-03-04 11:38:46 +01:00
ieee80211_radiotap.h mac80211: add radiotap flag to prevent sequence number overwrite 2020-07-31 09:27:00 +02:00
ieee802154_netdev.h net: ieee802154: return -EINVAL for unknown addr type 2022-10-26 13:25:55 +02:00
if_inet6.h net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX 2023-12-20 15:44:27 +01:00
ife.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set 2022-08-21 15:15:51 +02:00
inet_common.h bpf: Allow any port in bpf_bind helper 2020-05-09 00:48:20 +02:00
inet_connection_sock.h tcp: properly terminate timers for kernel sockets 2024-04-13 12:59:15 +02:00
inet_ecn.h inet_ecn: Fix endianness of checksum update when setting ECT(1) 2020-12-01 17:16:54 -08:00
inet_frag.h inet: frags: annotate races around fqdir->dead and fqdir->high_thresh 2022-01-27 10:54:33 +01:00
inet_hashtables.h net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set 2022-08-21 15:15:51 +02:00
inet_sock.h net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set 2022-08-21 15:15:51 +02:00
inet_timewait_sock.h
inetpeer.h
ip.h ipv4: ignore dst hint for multipath routes 2023-09-19 12:20:26 +02:00
ip6_checksum.h tcp: remove indirect calls for icsk->icsk_af_ops->send_check 2020-06-20 17:47:53 -07:00
ip6_fib.h ipv6: annotate accesses to fn->fn_sernum 2022-02-01 17:25:44 +01:00
ip6_route.h net: ipv6: fix returned variable type in ip6_skb_dst_mtu 2021-08-12 13:22:07 +02:00
ip6_tunnel.h ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode 2022-05-09 09:05:04 +02:00
ip_fib.h ipv4/fib: send notify when delete source address routes 2023-10-25 11:54:23 +02:00
ip_tunnels.h ip_tunnels: use DEV_STATS_INC() 2023-09-19 12:20:27 +02:00
ip_vs.h ipvs: Update width of source for ip_vs_sync_conn_options 2023-05-30 12:57:49 +01:00
ipcomp.h
ipconfig.h
ipv6.h ipv6: fix ip6_sock_set_addr_preferences() typo 2023-09-19 12:20:30 +02:00
ipv6_frag.h inet: frags: annotate races around fqdir->dead and fqdir->high_thresh 2022-01-27 10:54:33 +01:00
ipv6_stubs.h net: ipv6: add fib6_nh_release_dsts stub 2021-12-01 09:19:05 +01:00
ipx.h
iw_handler.h
kcm.h
l3mdev.h l3mdev: add infrastructure for table to VRF mapping 2020-06-20 17:22:22 -07:00
lag.h
lapb.h
lib80211.h
llc.h llc: fix out-of-bound array index in llc_sk_dev_hash() 2021-11-18 14:04:27 +01:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h llc: Drop support for ETH_P_TR_802_2. 2024-02-23 08:41:56 +01:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h lwt: Check LWTUNNEL_XMIT_CONTINUE strictly 2023-09-19 12:20:09 +02:00
mac80211.h mac80211: Fix NULL ptr deref for injected rate info 2021-06-23 14:42:52 +02:00
mac802154.h
macsec.h net: macsec: indicate next pn update when offloading 2023-10-25 11:54:14 +02:00
mip6.h
mld.h
mpls.h net: Make mpls_entry_encode() available for generic users 2020-05-29 21:20:20 -07:00
mpls_iptunnel.h
mptcp.h mptcp: remove MPTCP 'ifdef' in TCP SYN cookies 2023-01-14 10:16:51 +01:00
mrp.h mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-14 10:16:18 +01:00
ncsi.h
ndisc.h ipv6: ndisc: adjust ndisc_ifinfo_sysctl_change prototype 2020-08-24 06:40:07 -07:00
neighbour.h neighbour: delete neigh_lookup_nodev as not used 2023-06-21 15:45:40 +02:00
net_failover.h
net_namespace.h net: make get_net_ns return error if NET_NS is disabled 2021-06-23 14:42:44 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h netlink: export policy in extended ACK 2020-10-09 20:22:32 -07:00
netprio_cgroup.h
netrom.h
nexthop.h net: ipv4: Fix rtnexthop len when RTA_FLOW is present 2021-10-06 15:55:53 +02:00
nl802154.h net: ieee802154: handle iftypes as u32 2021-12-01 09:19:03 +01:00
nsh.h
p8022.h
page_pool.h mm: fix struct page layout on 32-bit systems 2021-05-19 10:13:17 +02:00
pie.h
ping.h
pkt_cls.h net: zero-initialize tc skb extension on allocation 2021-06-03 09:00:51 +02:00
pkt_sched.h net/sched: make psched_mtu() RTNL-less safe 2023-07-27 08:44:24 +02:00
pptp.h
protocol.h tcp/udp: Make early_demux back namespacified. 2022-11-10 18:14:26 +01:00
psample.h psample: Add a fwd declaration for skbuff 2021-08-18 08:59:11 +02:00
psnap.h
raw.h raw: Fix a data-race around sysctl_raw_l3mdev_accept. 2022-07-21 21:20:10 +02:00
rawv6.h
red.h sch_red: fix off-by-one checks in red_check_params() 2021-04-14 08:42:07 +02:00
regulatory.h net/wireless: regulatory.h: drop duplicate word in comment 2020-07-31 09:24:23 +02:00
request_sock.h tcp: bpf: Optionally store mac header in TCP_SAVE_SYN 2020-08-24 14:35:00 -07:00
rose.h
route.h lsm,selinux: pass flowi_common instead of flowi to the LSM hooks 2022-06-09 10:21:09 +02:00
rpl.h ipv6: rpl: Fix Route of Death. 2023-06-14 11:09:42 +02:00
rsi_91x.h
rtnetlink.h net: validate veth and vxcan peer ifindexes 2023-08-30 16:23:13 +02:00
rtnh.h
sch_generic.h net/sched: act_mirred: refactor the handle of xmit 2023-05-30 12:57:56 +01:00
scm.h scm: fix MSG_CTRUNC setting condition for SO_PASSSEC 2023-05-17 11:47:47 +02:00
secure_seq.h secure_seq: use the 64 bits of the siphash for port offset calculation 2022-05-30 09:33:23 +02:00
seg6.h seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds 2020-06-04 15:39:32 -07:00
seg6_hmac.h
seg6_local.h
slhc_vj.h
smc.h net/smc: introduce CHID callback for ISM devices 2020-09-28 15:19:03 -07:00
snmp.h
sock.h tcp: properly terminate timers for kernel sockets 2024-04-13 12:59:15 +02:00
sock_reuseport.h udp: Update reuse->has_conns under reuseport_lock. 2022-10-30 09:41:19 +01:00
Space.h
stp.h
strparser.h bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 14:04:27 +01:00
switchdev.h bridge: switchdev: Notify about VLAN protocol changes 2022-12-02 17:39:57 +01:00
tcp.h mptcp: fix lockless access in subflow ULP diag 2024-03-01 13:16:49 +01:00
tcp_states.h
timewait_sock.h
tipc.h
tls.h net/tls: Check for errors in tls_device_init 2022-07-21 21:20:13 +02:00
tls_toe.h
transp_v6.h tcp: move ipv4_specific to tcp include file 2020-06-23 20:10:15 -07:00
tso.h net: tso: cache transport header length 2020-06-18 20:46:23 -07:00
tun_proto.h
udp.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-04-26 11:27:41 +02:00
udp_tunnel.h udp: call udp_encap_enable for v6 sockets when enabling encap 2022-04-08 14:39:54 +02:00
udplite.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-04-26 11:27:41 +02:00
vsock_addr.h
vxlan.h vxlan: Fix nexthop hash size 2023-08-11 11:57:50 +02:00
wext.h
wimax.h net: wimax: fix duplicate words in comments 2020-07-15 20:34:02 -07:00
x25.h
x25device.h
xdp.h xdp: Remove the xdp_attachment_flags_ok() callback 2020-12-09 16:27:42 +01:00
xdp_priv.h
xdp_sock.h xsk: Fix race in SKB mode transmit with shared cq 2021-01-17 14:17:05 +01:00
xdp_sock_drv.h xsk: i40e: ice: ixgbe: mlx5: Test for dma_need_sync earlier for better performance 2020-08-31 21:15:04 +02:00
xfrm.h xfrm: Treat already-verified secpath entries as optional 2023-06-28 10:28:10 +02:00
xsk_buff_pool.h xsk: Fix unaligned descriptor validation 2023-05-17 11:47:50 +02:00