linux-kernel - Re: [PATCH] af_packet: Raw socket destruction warning fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <2036003091.741801453376409338.JavaMail.weblogic@ep2mlwas01a>
Date:	Thu, 21 Jan 2016 11:40:14 +0000 (GMT)
From:	Maninder Singh <maninder1.s@...sung.com>
To:	Daniel Borkmann <daniel@...earbox.net>,
	Vaneet Narang <v.narang@...sung.com>
Cc:	"davem@...emloft.net" <davem@...emloft.net>,
	"willemb@...gle.com" <willemb@...gle.com>,
	"edumazet@...gle.com" <edumazet@...gle.com>,
	"eyal.birger@...il.com" <eyal.birger@...il.com>,
	"tklauser@...tanz.ch" <tklauser@...tanz.ch>,
	"fruggeri@...stanetworks.com" <fruggeri@...stanetworks.com>,
	"dwmw2@...radead.org" <dwmw2@...radead.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	PANKAJ MISHRA <pankaj.m@...sung.com>,
	Geon-ho Kim <gh007.kim@...sung.com>,
	Hak-Bong Lee <hakbong5.lee@...sung.com>
Subject: Re: [PATCH] af_packet: Raw socket destruction warning fix

Hi Daniel,

>The other sock_put() in packet_release() to drop the final ref and call into
>sk_free(), which drops the 1 ref on the sk_wmem_alloc from init time. Since you
>got into __sk_free() via sock_wfree() destructor, your socket must have invoked
>packet_release() prior to this (perhaps kernel destroying the process).
>
>What kernel do you use?

Issue is coming for 3.10.58.

>> Driver calls dev_kfree_skb_any->dev_kfree_skb_irq
>> and it adds buffer in completion queue to free and raises softirq NET_TX_SOFTIRQ
>>
>> net_tx_action->__kfree_skb->skb_release_all->skb_release_head_state->sock_wfree->
>> __sk_free->packet_sock_destruct
>>
>> Also purging of receive queue has been taken care in other protocols.