netdev - Re: [PATCH net] net: better track kernel sockets lifetime

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250221044058.82532-1-kuniyu@amazon.com>
Date: Thu, 20 Feb 2025 20:40:58 -0800
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <edumazet@...gle.com>
CC: <davem@...emloft.net>, <eric.dumazet@...il.com>, <kuba@...nel.org>,
	<kuniyu@...zon.com>, <netdev@...r.kernel.org>, <pabeni@...hat.com>,
	<syzbot+30a19e01a97420719891@...kaller.appspotmail.com>
Subject: Re: [PATCH net] net: better track kernel sockets lifetime

From: Eric Dumazet <edumazet@...gle.com>
Date: Thu, 20 Feb 2025 13:18:54 +0000
> While kernel sockets are dismantled during pernet_operations->exit(),
> their freeing can be delayed by any tx packets still held in qdisc
> or device queues, due to skb_set_owner_w() prior calls.
> 
> This then trigger the following warning from ref_tracker_dir_exit() [1]
> 
> To fix this, make sure that kernel sockets own a reference on net->passive.
> 
> Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket
> is converted to a refcounted one.
> 
> [1]
> 
> [  136.263918][   T35] ref_tracker: net notrefcnt@...f8880638f01e0 has 1/2 users at
> [  136.263918][   T35]      sk_alloc+0x2b3/0x370
> [  136.263918][   T35]      inet6_create+0x6ce/0x10f0
> [  136.263918][   T35]      __sock_create+0x4c0/0xa30
> [  136.263918][   T35]      inet_ctl_sock_create+0xc2/0x250
> [  136.263918][   T35]      igmp6_net_init+0x39/0x390
> [  136.263918][   T35]      ops_init+0x31e/0x590
> [  136.263918][   T35]      setup_net+0x287/0x9e0
> [  136.263918][   T35]      copy_net_ns+0x33f/0x570
> [  136.263918][   T35]      create_new_namespaces+0x425/0x7b0
> [  136.263918][   T35]      unshare_nsproxy_namespaces+0x124/0x180
> [  136.263918][   T35]      ksys_unshare+0x57d/0xa70
> [  136.263918][   T35]      __x64_sys_unshare+0x38/0x40
> [  136.263918][   T35]      do_syscall_64+0xf3/0x230
> [  136.263918][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f
> [  136.263918][   T35]
> [  136.343488][   T35] ref_tracker: net notrefcnt@...f8880638f01e0 has 1/2 users at
> [  136.343488][   T35]      sk_alloc+0x2b3/0x370
> [  136.343488][   T35]      inet6_create+0x6ce/0x10f0
> [  136.343488][   T35]      __sock_create+0x4c0/0xa30
> [  136.343488][   T35]      inet_ctl_sock_create+0xc2/0x250
> [  136.343488][   T35]      ndisc_net_init+0xa7/0x2b0
> [  136.343488][   T35]      ops_init+0x31e/0x590
> [  136.343488][   T35]      setup_net+0x287/0x9e0
> [  136.343488][   T35]      copy_net_ns+0x33f/0x570
> [  136.343488][   T35]      create_new_namespaces+0x425/0x7b0
> [  136.343488][   T35]      unshare_nsproxy_namespaces+0x124/0x180
> [  136.343488][   T35]      ksys_unshare+0x57d/0xa70
> [  136.343488][   T35]      __x64_sys_unshare+0x38/0x40
> [  136.343488][   T35]      do_syscall_64+0xf3/0x230
> [  136.343488][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fixes: 0cafd77dcd03 ("net: add a refcount tracker for kernel sockets")
> Reported-by: syzbot+30a19e01a97420719891@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/67b72aeb.050a0220.14d86d.0283.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Thanks!