From nobody Mon Apr 6 13:29:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E7B5C07E9D for ; Tue, 27 Sep 2022 16:13:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232675AbiI0QNh (ORCPT ); Tue, 27 Sep 2022 12:13:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48974 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231631AbiI0QNe (ORCPT ); Tue, 27 Sep 2022 12:13:34 -0400 Received: from smtp-fw-33001.amazon.com (smtp-fw-33001.amazon.com [207.171.190.10]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 82A7E915D5; Tue, 27 Sep 2022 09:13:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1664295213; x=1695831213; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4gy6y9RluD7Ishn0pzYcwsWmftF1WClFyBmqV8OA2xs=; b=Hekt2o2ez/lZUHbbZnMVOz81q+cvUuB4h5QpI8zTyVx/Ea1iZXxyjXqg XgqMPVVnWvMpQL8KMw0xiJTpEOHD3GdMUCtNQo2LSpDuxriibQdo6kGJn ilVL4SgtF0BULRSyX6lBCQ/cLfQ/e/tv3rVdS/ZkWrQzaljyqjq0U/Glm Q=; X-IronPort-AV: E=Sophos;i="5.93,349,1654560000"; d="scan'208";a="228971190" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-iad-1a-828bd003.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-33001.sea14.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Sep 2022 16:13:17 +0000 Received: from EX13MTAUWB001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan2.iad.amazon.com [10.40.163.34]) by email-inbound-relay-iad-1a-828bd003.us-east-1.amazon.com (Postfix) with ESMTPS id 24AE7804B3; Tue, 27 Sep 2022 16:13:14 +0000 (UTC) Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX13MTAUWB001.ant.amazon.com (10.43.161.207) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Tue, 27 Sep 2022 16:13:13 +0000 Received: from 88665a182662.ant.amazon.com (10.43.160.214) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.12; Tue, 27 Sep 2022 16:13:10 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , David Ahern CC: Kuniyuki Iwashima , Kuniyuki Iwashima , , , , "Vladislav Yasevich" Subject: [PATCH v1 net 3/5] tcp/udp: Call inet6_destroy_sock() in IPv4 sk_prot->destroy(). Date: Tue, 27 Sep 2022 09:12:07 -0700 Message-ID: <20220927161209.32939-4-kuniyu@amazon.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220927161209.32939-1-kuniyu@amazon.com> References: <20220927161209.32939-1-kuniyu@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.43.160.214] X-ClientProxiedBy: EX13D13UWA002.ant.amazon.com (10.43.160.172) To EX19D004ANA001.ant.amazon.com (10.37.240.138) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Originally, inet6_sk(sk)->XXX were changed under lock_sock(), so we were able to clean them up by calling inet6_destroy_sock() during the IPv6 -> IPv4 conversion by IPV6_ADDRFORM. However, commit 03485f2adcde ("udpv6: Add lockless sendmsg() support") added a lockless memory allocation path, which could cause a memory leak: setsockopt(IPV6_ADDRFORM) sendmsg() +-----------------------+ +-------+ - do_ipv6_setsockopt(sk, ...) - udpv6_sendmsg(sk, ...) - lock_sock(sk) ^._ called via udpv6_prot - WRITE_ONCE(sk->sk_prot, &tcp_prot) before WRITE_ONCE() - inet6_destroy_sock() - release_sock(sk) - ip6_make_skb(sk, ...) ^._ lockless fast path for the non-corking case - __ip6_append_data(sk, ...) - ipv6_local_rxpmtu(sk, ...) - xchg(&np->rxpmtu, skb) ^._ rxpmtu is never fre= ed. - lock_sock(sk) For now, rxpmtu is only the case, but let's call inet6_destroy_sock() in both TCP/UDP v4 destroy functions not to miss the future change. We can consolidate TCP/UDP v4/v6 destroy functions, but such changes are too invasive to backport to stable. So, they can be posted as a follow-up later for net-next. Fixes: 03485f2adcde ("udpv6: Add lockless sendmsg() support") Signed-off-by: Kuniyuki Iwashima --- Cc: Vladislav Yasevich --- net/ipv4/tcp_ipv4.c | 5 +++++ net/ipv4/udp.c | 6 ++++++ net/ipv6/tcp_ipv6.c | 1 - 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 5b019ba2b9d2..035b6c52a243 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -2263,6 +2263,11 @@ void tcp_v4_destroy_sock(struct sock *sk) tcp_saved_syn_free(tp); =20 sk_sockets_allocated_dec(sk); + +#if IS_ENABLED(CONFIG_IPV6) + if (sk->sk_prot_creator =3D=3D &tcpv6_prot) + inet6_destroy_sock(sk); +#endif } EXPORT_SYMBOL(tcp_v4_destroy_sock); =20 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 560d9eadeaa5..cdf131c0a819 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -115,6 +115,7 @@ #include #if IS_ENABLED(CONFIG_IPV6) #include +#include #endif =20 struct udp_table udp_table __read_mostly; @@ -2666,6 +2667,11 @@ void udp_destroy_sock(struct sock *sk) if (up->encap_enabled) static_branch_dec(&udp_encap_needed_key); } + +#if IS_ENABLED(CONFIG_IPV6) + if (sk->sk_prot_creator =3D=3D &udpv6_prot) + inet6_destroy_sock(sk); +#endif } =20 /* diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index e54eee80ce5f..1ff6a92f7774 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1945,7 +1945,6 @@ static int tcp_v6_init_sock(struct sock *sk) static void tcp_v6_destroy_sock(struct sock *sk) { tcp_v4_destroy_sock(sk); - inet6_destroy_sock(sk); } =20 #ifdef CONFIG_PROC_FS --=20 2.30.2