netdev - Re: [bpf-next PATCH 1/4] bpf: sockmap, free memory on sock close with cork data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Apr 2018 15:13:23 +0200
From:   Simon Horman <simon.horman@...ronome.com>
To:     John Fastabend <john.fastabend@...il.com>
Cc:     ast@...nel.org, daniel@...earbox.net, netdev@...r.kernel.org,
        davem@...emloft.net
Subject: Re: [bpf-next PATCH 1/4] bpf: sockmap, free memory on sock close
 with cork data

On Sun, Apr 01, 2018 at 08:00:54AM -0700, John Fastabend wrote:
> If a socket with pending cork data is closed we do not return the
> memory to the socket until the garbage collector free's the psock
> structure. The garbage collector though can run after the sock has
> completed its close operation. If this ordering happens the sock code
> will through a WARN_ON because there is still outstanding memory

s/through/throw/ ?

> accounted to the sock.
> 
> To resolve this ensure we return memory to the sock when a socket
> is closed.
> 
> Signed-off-by: John Fastabend <john.fastabend@...il.com>
> Fixes: 91843d540a13 ("bpf: sockmap, add msg_cork_bytes() helper")
> ---
>  kernel/bpf/sockmap.c |    6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
> index d2bda5a..8ddf326 100644
> --- a/kernel/bpf/sockmap.c
> +++ b/kernel/bpf/sockmap.c
> @@ -211,6 +211,12 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
>  	close_fun = psock->save_close;
>  
>  	write_lock_bh(&sk->sk_callback_lock);
> +	if (psock->cork) {
> +		free_start_sg(psock->sock, psock->cork);
> +		kfree(psock->cork);
> +		psock->cork = NULL;
> +	}
> +
>  	list_for_each_entry_safe(md, mtmp, &psock->ingress, list) {
>  		list_del(&md->list);
>  		free_start_sg(psock->sock, md);
>