netdev - Re: Kernel oops with 6.14 when enabling TLS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d6e65c4c-a575-4389-a801-2ba40e1d25e1@suse.cz>
Date: Wed, 5 Mar 2025 09:58:44 +0100
From: Vlastimil Babka <vbabka@...e.cz>
To: Hannes Reinecke <hare@...e.com>, Hannes Reinecke <hare@...e.de>,
 Matthew Wilcox <willy@...radead.org>
Cc: Boris Pismenny <borisp@...dia.com>,
 John Fastabend <john.fastabend@...il.com>, Jakub Kicinski <kuba@...nel.org>,
 Sagi Grimberg <sagi@...mberg.me>,
 "linux-nvme@...ts.infradead.org" <linux-nvme@...ts.infradead.org>,
 "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>,
 linux-mm@...ck.org, Harry Yoo <harry.yoo@...cle.com>,
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: Kernel oops with 6.14 when enabling TLS

On 3/5/25 09:20, Hannes Reinecke wrote:
> On 3/4/25 20:44, Vlastimil Babka wrote:
>> On 3/4/25 20:39, Hannes Reinecke wrote:
> [ .. ]
>>>
>>> Good news and bad news ...
>>> Good news: TLS works again!
>>> Bad news: no errors.
>> 
>> Wait, did you add a WARN_ON_ONCE() to the put_page() as I suggested? If yes
>> and there was no error, it would have to be leaking the page. Or the path
>> uses folio_put() and we'd need to put the warning there.
>> 
> That triggers:
...
> Not surprisingly, though, as the original code did a get_page(), so
> there had to be a corresponding put_page() somewhere.

Is is this one? If there's no more warning afterwards, that should be it.

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 61f3f3d4e528..b37d99cec069 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -182,9 +182,14 @@ static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
 
        /* When the skb owns the memory we free it from consume_skb path. */
        if (!msg->skb) {
+               struct folio *folio;
+
                if (charge)
                        sk_mem_uncharge(sk, len);
-               put_page(sg_page(sge));
+
+               folio = page_folio(sg_page(sge));
+               if (!folio_test_slab(folio))
+                       folio_put(folio);
        }
        memset(sge, 0, sizeof(*sge));
        return len;