netdev - [PATCH V2 net] udp: do not use skb_release_head_state() before skb_attempt_defer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251014132917.2841932-1-edumazet@google.com>
Date: Tue, 14 Oct 2025 13:29:17 +0000
From: Eric Dumazet <edumazet@...gle.com>
To: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>, Willem de Bruijn <willemb@...gle.com>, netdev@...r.kernel.org, 
	eric.dumazet@...il.com, Eric Dumazet <edumazet@...gle.com>, 
	Michal Kubecek <mkubecek@...e.cz>, Sabrina Dubroca <sd@...asysnail.net>
Subject: [PATCH V2 net] udp: do not use skb_release_head_state() before skb_attempt_defer_free()

Michal reported and bisected an issue after recent adoption
of skb_attempt_defer_free() in UDP.

The issue here is that skb_release_head_state() is called twice per skb,
one time from skb_consume_udp(), then a second time from skb_defer_free_flush()
and napi_consume_skb().

As Sabrina suggested, remove skb_release_head_state() call from
skb_consume_udp() before calling skb_attempt_defer_free().

Add three DEBUG_NET_WARN_ON_ONCE() to check that dst, destructor
and skb_nfct() are not set at this point.

Many thanks to Michal, Sabrina and Paolo for their help.

Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()")
Reported-and-bisected-by: Michal Kubecek <mkubecek@...e.cz>
Closes: https://lore.kernel.org/netdev/gpjh4lrotyephiqpuldtxxizrsg6job7cvhiqrw72saz2ubs3h@g6fgbvexgl3r/
Signed-off-by: Eric Dumazet <edumazet@...gle.com>
Tested-by: Michal Kubecek <mkubecek@...e.cz>
Cc: Sabrina Dubroca <sd@...asysnail.net>
---
v2: Adopted Sabrina suggestion.
v1: https://lore.kernel.org/netdev/aO3_hBg5expKNv6v@krikkit/T/#m8a88669b801d85f57b73710cdb0c8ee63854af11

 net/ipv4/udp.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 95241093b7f0..d66f273f9070 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1851,8 +1851,13 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)
 		sk_peek_offset_bwd(sk, len);
 
 	if (!skb_shared(skb)) {
-		if (unlikely(udp_skb_has_head_state(skb)))
-			skb_release_head_state(skb);
+		/* Make sure that this skb has no dst, destructor
+		 * or conntracking parts, because it might stay
+		 * in a remote cpu list for a very long time.
+		 */
+		DEBUG_NET_WARN_ON_ONCE(skb_dst(skb));
+		DEBUG_NET_WARN_ON_ONCE(skb->destructor);
+		DEBUG_NET_WARN_ON_ONCE(skb_nfct(skb));
 		skb_attempt_defer_free(skb);
 		return;
 	}
-- 
2.51.0.788.g6d19910ace-goog