netdev - Re: [PATCH v2 net 2/3] udp: Fix memory accounting leak.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <67e40aa9c8de1_4bb5c2945@willemb.c.googlers.com.notmuch>
Date: Wed, 26 Mar 2025 10:09:45 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Kuniyuki Iwashima <kuniyu@...zon.com>, 
 Willem de Bruijn <willemdebruijn.kernel@...il.com>, 
 "David S. Miller" <davem@...emloft.net>, 
 David Ahern <dsahern@...nel.org>, 
 Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>, 
 Kuniyuki Iwashima <kuniyu@...zon.com>, 
 Kuniyuki Iwashima <kuni1840@...il.com>, 
 netdev@...r.kernel.org, 
 Matt Dowling <madowlin@...zon.com>
Subject: Re: [PATCH v2 net 2/3] udp: Fix memory accounting leak.

Kuniyuki Iwashima wrote:
> Matt Dowling reported a weird UDP memory usage issue.
> 
> Under normal operation, the UDP memory usage reported in /proc/net/sockstat
> remains close to zero.  However, it occasionally spiked to 524,288 pages
> and never dropped.  Moreover, the value doubled when the application was
> terminated.  Finally, it caused intermittent packet drops.
> 
> We can reproduce the issue with the script below [0]:
> 
>   1. /proc/net/sockstat reports 0 pages
> 
>     # cat /proc/net/sockstat | grep UDP:
>     UDP: inuse 1 mem 0
> 
>   2. Run the script till the report reaches 524,288
> 
>     # python3 test.py & sleep 5
>     # cat /proc/net/sockstat | grep UDP:
>     UDP: inuse 3 mem 524288  <-- (INT_MAX + 1) >> PAGE_SHIFT
> 
>   3. Kill the socket and confirm the number never drops
> 
>     # pkill python3 && sleep 5
>     # cat /proc/net/sockstat | grep UDP:
>     UDP: inuse 1 mem 524288
> 
>   4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()
> 
>     # python3 test.py & sleep 1 && pkill python3
> 
>   5. The number doubles
> 
>     # cat /proc/net/sockstat | grep UDP:
>     UDP: inuse 1 mem 1048577
> 
> The application set INT_MAX to SO_RCVBUF, which triggered an integer
> overflow in udp_rmem_release().
> 
> When a socket is close()d, udp_destruct_common() purges its receive
> queue and sums up skb->truesize in the queue.  This total is calculated
> and stored in a local unsigned integer variable.
> 
> The total size is then passed to udp_rmem_release() to adjust memory
> accounting.  However, because the function takes a signed integer
> argument, the total size can wrap around, causing an overflow.
> 
> Then, the released amount is calculated as follows:
> 
>   1) Add size to sk->sk_forward_alloc.
>   2) Round down sk->sk_forward_alloc to the nearest lower multiple of
>       PAGE_SIZE and assign it to amount.
>   3) Subtract amount from sk->sk_forward_alloc.
>   4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().
> 
> When the issue occurred, the total in udp_destruct_common() was 2147484480
> (INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().
> 
> At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and
> 2) sets -2147479552 to amount.  3) reverts the wraparound, so we don't
> see a warning in inet_sock_destruct().  However, udp_memory_allocated
> ends up doubling at 4).
> 
> Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for
> memory_allocated"), memory usage no longer doubles immediately after
> a socket is close()d because __sk_mem_reduce_allocated() caches the
> amount in udp_memory_per_cpu_fw_alloc.  However, the next time a UDP
> socket receives a packet, the subtraction takes effect, causing UDP
> memory usage to double.
> 
> This issue makes further memory allocation fail once the socket's
> sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet
> drops.
> 
> To prevent this issue, let's use unsigned int for the calculation and
> call sk_forward_alloc_add() only once for the small delta.
> 
> Note that first_packet_length() also potentially has the same problem.
> 
> [0]:
> from socket import *
> 
> SO_RCVBUFFORCE = 33
> INT_MAX = (2 ** 31) - 1
> 
> s = socket(AF_INET, SOCK_DGRAM)
> s.bind(('', 0))
> s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)
> 
> c = socket(AF_INET, SOCK_DGRAM)
> c.connect(s.getsockname())
> 
> data = b'a' * 100
> 
> while True:
>     c.send(data)
> 
> Fixes: f970bd9e3a06 ("udp: implement memory accounting helpers")
> Reported-by: Matt Dowling <madowlin@...zon.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Reviewed-by: Willem de Bruijn <willemb@...gle.com>