netdev - WARNING in sk_stream_kill_queues due to inet6_destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <39725AB4-88F1-41B3-B07F-949C5CAEFF4F@icloud.com>
Date:   Wed, 1 Feb 2023 10:22:42 -0800
From:   Christoph Paasch <christophpaasch@...oud.com>
To:     Kuniyuki Iwashima <kuniyu@...zon.com>
Cc:     Paolo Abeni <pabeni@...hat.com>,
        Matthieu Baerts <notifications@...hub.com>,
        netdev <netdev@...r.kernel.org>
Subject: WARNING in sk_stream_kill_queues due to inet6_destroy_sock()-changes

Hello,

I am running a syzkaller instance and hit an issue where sk_forward_alloc is not 0 in sk_stream_kill_queues().

I bisected this issue down to the set of changes from the "inet6: Remove inet6_destroy_sock() calls”-series (see below for the commit hashes).

The reproducer is:
Reproducer:
# {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false UseTmpDir:false HandleSegv:false Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000080), 0x8)
setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000040)=0x8, 0x4)
sendmsg$inet6(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c, 0x0}, 0x200880c0)

What ends up happening is that np->pktoptions is not emptied thus the skb’s that have been added there are still accounted in sk_forward_alloc.


I’m not sure what would be the best way to fix this, besides a plain revert of this patchset as sk_stream_kill_queues() does rely on the things to have been free’d.


More information on the syzkaller issue can be found at https://github.com/multipath-tcp/mptcp_net-next/issues/341.


Cheers,
Christoph


b45a337f061e ("inet6: Clean up failure path in do_ipv6_setsockopt().")  (3 months ago) <Kuniyuki Iwashima>
1f8c4eeb9455 ("inet6: Remove inet6_destroy_sock().")  (3 months ago) <Kuniyuki Iwashima>
6431b0f6ff16 ("sctp: Call inet6_destroy_sock() via sk->sk_destruct().")  (3 months ago) <Kuniyuki Iwashima>
1651951ebea5 ("dccp: Call inet6_destroy_sock() via sk->sk_destruct().")  (3 months ago) <Kuniyuki Iwashima>
b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().")  (3 months ago) <Kuniyuki Iwashima>