netdev - Re: WARNING in sk_stream_kill_queues due to inet6_destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230201184316.17991-1-kuniyu@amazon.com>
Date:   Wed, 1 Feb 2023 10:43:16 -0800
From:   Kuniyuki Iwashima <kuniyu@...zon.com>
To:     <christophpaasch@...oud.com>
CC:     <kuniyu@...zon.com>, <netdev@...r.kernel.org>,
        <notifications@...hub.com>, <pabeni@...hat.com>
Subject: Re: WARNING in sk_stream_kill_queues due to inet6_destroy_sock()-changes

From:   Christoph Paasch <christophpaasch@...oud.com>
Date:   Wed, 1 Feb 2023 10:22:42 -0800
> Hello,
> 
> I am running a syzkaller instance and hit an issue where sk_forward_alloc is not 0 in sk_stream_kill_queues().
> 
> I bisected this issue down to the set of changes from the "inet6: Remove inet6_destroy_sock() calls”-series (see below for the commit hashes).
> 
> The reproducer is:
> Reproducer:
> # {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false UseTmpDir:false HandleSegv:false Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
> r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
> bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
> setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000080), 0x8)
> setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000040)=0x8, 0x4)
> sendmsg$inet6(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0xa, 0x4e22, 0x0, @loopback}, 0x1c, 0x0}, 0x200880c0)
> 
> What ends up happening is that np->pktoptions is not emptied thus the skb’s that have been added there are still accounted in sk_forward_alloc.
> 
> 
> I’m not sure what would be the best way to fix this, besides a plain revert of this patchset as sk_stream_kill_queues() does rely on the things to have been free’d.
> 
> 
> More information on the syzkaller issue can be found at https://github.com/multipath-tcp/mptcp_net-next/issues/341.

Thanks for bisecting and reporting!

I missed that WARN_ON_ONCE(), I'll post a fix.

Thank you,
Kuniyuki


> 
> Cheers,
> Christoph
> 
> 
> b45a337f061e ("inet6: Clean up failure path in do_ipv6_setsockopt().")  (3 months ago) <Kuniyuki Iwashima>
> 1f8c4eeb9455 ("inet6: Remove inet6_destroy_sock().")  (3 months ago) <Kuniyuki Iwashima>
> 6431b0f6ff16 ("sctp: Call inet6_destroy_sock() via sk->sk_destruct().")  (3 months ago) <Kuniyuki Iwashima>
> 1651951ebea5 ("dccp: Call inet6_destroy_sock() via sk->sk_destruct().")  (3 months ago) <Kuniyuki Iwashima>
> b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().")  (3 months ago) <Kuniyuki Iwashima>