Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1d8a87d6 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Greg Kroah-Hartman
Browse files

tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 



commit d38afeec26ed4739c640bf286c270559aab2ba5f upstream.

Originally, inet6_sk(sk)->XXX were changed under lock_sock(), so we were
able to clean them up by calling inet6_destroy_sock() during the IPv6 ->
IPv4 conversion by IPV6_ADDRFORM.  However, commit 03485f2a ("udpv6:
Add lockless sendmsg() support") added a lockless memory allocation path,
which could cause a memory leak:

setsockopt(IPV6_ADDRFORM)                 sendmsg()
+-----------------------+                 +-------+
- do_ipv6_setsockopt(sk, ...)             - udpv6_sendmsg(sk, ...)
  - sockopt_lock_sock(sk)                   ^._ called via udpv6_prot
    - lock_sock(sk)                             before WRITE_ONCE()
  - WRITE_ONCE(sk->sk_prot, &tcp_prot)
  - inet6_destroy_sock()                    - if (!corkreq)
  - sockopt_release_sock(sk)                  - ip6_make_skb(sk, ...)
    - release_sock(sk)                          ^._ lockless fast path for
                                                    the non-corking case

                                                - __ip6_append_data(sk, ...)
                                                  - ipv6_local_rxpmtu(sk, ...)
                                                    - xchg(&np->rxpmtu, skb)
                                                      ^._ rxpmtu is never freed.

                                                - goto out_no_dst;

                                            - lock_sock(sk)

For now, rxpmtu is only the case, but not to miss the future change
and a similar bug fixed in commit e27326009a3d ("net: ping6: Fix
memleak in ipv6_renew_options()."), let's set a new function to IPv6
sk->sk_destruct() and call inet6_cleanup_sock() there.  Since the
conversion does not change sk->sk_destruct(), we can guarantee that
we can clean up IPv6 resources finally.

We can now remove all inet6_destroy_sock() calls from IPv6 protocol
specific ->destroy() functions, but such changes are invasive to
backport.  So they can be posted as a follow-up later for net-next.

Fixes: 03485f2a ("udpv6: Add lockless sendmsg() support")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9577d9f0

include/net/ipv6.h

+1 −0
Original line number Diff line number Diff line
@@ -1041,6 +1041,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info); 
void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu);



void inet6_cleanup_sock(struct sock *sk);

void inet6_sock_destruct(struct sock *sk);

int inet6_release(struct socket *sock);

int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);

int inet6_getname(struct socket *sock, struct sockaddr *uaddr,

include/net/udp.h

+1 −1
Original line number Diff line number Diff line
@@ -254,7 +254,7 @@ static inline int udp_rqueue_get(struct sock *sk) 
}



/* net/ipv4/udp.c */

void udp_destruct_sock(struct sock *sk);

void udp_destruct_common(struct sock *sk);

void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len);

int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb);

void udp_skb_destructor(struct sock *sk, struct sk_buff *skb);

include/net/udplite.h

+0 −8
Original line number Diff line number Diff line
@@ -24,14 +24,6 @@ static __inline__ int udplite_getfrag(void *from, char *to, int offset, 
	return copy_from_iter_full(to, len, &msg->msg_iter) ? 0 : -EFAULT;

}



/* Designate sk as UDP-Lite socket */

static inline int udplite_sk_init(struct sock *sk)

{

	udp_init_sock(sk);

	udp_sk(sk)->pcflag = UDPLITE_BIT;

	return 0;

}



/*

 * 	Checksumming routines

 */

net/ipv4/udp.c

+6 −3
Original line number Diff line number Diff line
@@ -1458,7 +1458,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) 
}

EXPORT_SYMBOL_GPL(__udp_enqueue_schedule_skb);



void udp_destruct_sock(struct sock *sk)

void udp_destruct_common(struct sock *sk)

{

	/* reclaim completely the forward allocated memory */

	struct udp_sock *up = udp_sk(sk);
@@ -1471,10 +1471,14 @@ void udp_destruct_sock(struct sock *sk) 
		kfree_skb(skb);

	}

	udp_rmem_release(sk, total, 0, true);

}

EXPORT_SYMBOL_GPL(udp_destruct_common);



static void udp_destruct_sock(struct sock *sk)

{

	udp_destruct_common(sk);

	inet_sock_destruct(sk);

}

EXPORT_SYMBOL_GPL(udp_destruct_sock);



int udp_init_sock(struct sock *sk)

{
@@ -1482,7 +1486,6 @@ int udp_init_sock(struct sock *sk) 
	sk->sk_destruct = udp_destruct_sock;

	return 0;

}

EXPORT_SYMBOL_GPL(udp_init_sock);



void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)

{

net/ipv4/udplite.c

+8 −0
Original line number Diff line number Diff line
@@ -20,6 +20,14 @@ 
struct udp_table 	udplite_table __read_mostly;

EXPORT_SYMBOL(udplite_table);



/* Designate sk as UDP-Lite socket */

static int udplite_sk_init(struct sock *sk)

{

	udp_init_sock(sk);

	udp_sk(sk)->pcflag = UDPLITE_BIT;

	return 0;

}



static int udplite_rcv(struct sk_buff *skb)

{

	return __udp4_lib_rcv(skb, &udplite_table, IPPROTO_UDPLITE);