From nobody Sun Feb 8 10:15:22 2026 Received: from mailgw01.mediatek.com (unknown [60.244.123.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 660E75695; Fri, 25 Apr 2025 12:31:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=60.244.123.138 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745584286; cv=none; b=oEnB4kRELxHxQc1i35dYPxocLRc0hZ32tlbU203Bl1zPdkeZ3dpbkRng9BHeQx1T2GMgc7foAvuWUpbfVXThP1kQU02Bb2VyaBFcHpeO5mjJzxytoSdbhXjRSXUUVZjOkeE1Vch9RpxUmt1XGLBeze04f3D8JOkfbUwaosVmt74= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745584286; c=relaxed/simple; bh=mXLsFPPFsBURdJfhP1NKqrNjYJ5DFZkpY6MJs2kdvkQ=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=LyIGMMsOxOFLN3MsOg24OVo4da9935aiJtuN89tGpjynQgS6HeLwBiwYDaPqVo09K+pwevfDh+oGSylQb0XJnsb+inzZfySDrxk278sQJYpOcdeNqt0ZzMHlagLf7RWgk+/0PSJbTsPhYPbRAQlly/mBxp4qGJiug+7tx0O0ccs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com; spf=pass smtp.mailfrom=mediatek.com; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b=C4KGDrKS; arc=none smtp.client-ip=60.244.123.138 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=mediatek.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mediatek.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mediatek.com header.i=@mediatek.com header.b="C4KGDrKS" X-UUID: 2a9111a821d111f0980a8d1746092496-20250425 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=LpBRKr0cZRLIHevWTWQoGj/eG6iewYGfCh3UgiIk+eI=; b=C4KGDrKS4flHPBO+C4QXwXugUsg206q+m0BOmMLAQ2fjYM3qnnUfLaZTqwKy8x+RTuRm9Tgy1gQSZYU1UFAd6u627xNLCueQo5vX5pSSAWjUhk4PLSFZw6U/a8+S2eUkaNCOVnLPhwGMNOSagnkBuA8eNXSKF0bj3KwsWfJElqg=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.2.1,REQID:8af11324-b437-4099-9298-e2c2df9d859a,IP:0,UR L:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:-25 X-CID-META: VersionHash:0ef645f,CLOUDID:4f689ef0-ff26-40e8-a637-f0e9524b171a,B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0|50,EDM:-3,IP:ni l,URL:0,File:nil,RT:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES :1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 0 X-CID-BAS: 0,_,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-UUID: 2a9111a821d111f0980a8d1746092496-20250425 Received: from mtkmbs14n2.mediatek.inc [(172.21.101.76)] by mailgw01.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1819063952; Fri, 25 Apr 2025 20:31:09 +0800 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs11n2.mediatek.inc (172.21.101.187) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.39; Fri, 25 Apr 2025 20:31:08 +0800 Received: from mbjsdccf07.gcn.mediatek.inc (10.15.20.246) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.1258.39 via Frontend Transport; Fri, 25 Apr 2025 20:31:07 +0800 From: Shiming Cheng To: , , , , , , , , , , , CC: , Jibin Zhang Subject: [PATCH v2] net: use inet_twsk_put() when sk_state is TCP_TIME_WAIT Date: Fri, 25 Apr 2025 20:33:48 +0800 Message-ID: <20250425123354.29254-1-shiming.cheng@mediatek.com> X-Mailer: git-send-email 2.45.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MTK: N Content-Type: text/plain; charset="utf-8" From: Jibin Zhang It is possible for a pointer of type struct inet_timewait_sock to be returned from the functions __inet_lookup_established() and __inet6_lookup_established(). This can cause a crash when the returned pointer is of type struct inet_timewait_sock and sock_put() is called on it. The following is a crash call stack that shows sk->sk_wmem_alloc being accessed in sk_free() during the call to sock_put() on a struct inet_timewait_sock pointer. To avoid this issue, use inet_twsk_put() instead of sock_put() when sk->sk_state is TCP_TIME_WAIT. mrdump.ko ipanic() + 120 vmlinux notifier_call_chain(nr_to_call=3D-1, nr_calls=3D0) + 132 vmlinux atomic_notifier_call_chain(val=3D0) + 56 vmlinux panic() + 344 vmlinux add_taint() + 164 vmlinux end_report() + 136 vmlinux kasan_report(size=3D0) + 236 vmlinux report_tag_fault() + 16 vmlinux do_tag_recovery() + 16 vmlinux __do_kernel_fault() + 88 vmlinux do_bad_area() + 28 vmlinux do_tag_check_fault() + 60 vmlinux do_mem_abort() + 80 vmlinux el1_abort() + 56 vmlinux el1h_64_sync_handler() + 124 vmlinux > 0xFFFFFFC080011294() vmlinux __lse_atomic_fetch_add_release(v=3D0xF2FFFF82A896087C) vmlinux __lse_atomic_fetch_sub_release(v=3D0xF2FFFF82A896087C) vmlinux arch_atomic_fetch_sub_release(i=3D1, v=3D0xF2FFFF82A896087= C) + 8 vmlinux raw_atomic_fetch_sub_release(i=3D1, v=3D0xF2FFFF82A896087C) + 8 vmlinux atomic_fetch_sub_release(i=3D1, v=3D0xF2FFFF82A896087C) + 8 vmlinux __refcount_sub_and_test(i=3D1, r=3D0xF2FFFF82A896087C, oldp=3D0) + 8 vmlinux __refcount_dec_and_test(r=3D0xF2FFFF82A896087C, oldp=3D0) = + 8 vmlinux refcount_dec_and_test(r=3D0xF2FFFF82A896087C) + 8 vmlinux sk_free(sk=3D0xF2FFFF82A8960700) + 28 vmlinux sock_put() + 48 vmlinux tcp6_check_fraglist_gro() + 236 vmlinux tcp6_gro_receive() + 624 vmlinux ipv6_gro_receive() + 912 vmlinux dev_gro_receive() + 1116 vmlinux napi_gro_receive() + 196 ccmni.ko ccmni_rx_callback() + 208 ccmni.ko ccmni_queue_recv_skb() + 388 ccci_dpmaif.ko dpmaif_rxq_push_thread() + 1088 vmlinux kthread() + 268 vmlinux 0xFFFFFFC08001F30C() Signed-off-by: Jibin Zhang --- net/ipv4/tcp_offload.c | 8 ++++++-- net/ipv6/tcpv6_offload.c | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index 2308665b51c5..95d7cbf6a2b5 100644 --- a/net/ipv4/tcp_offload.c +++ b/net/ipv4/tcp_offload.c @@ -431,8 +431,12 @@ static void tcp4_check_fraglist_gro(struct list_head *= head, struct sk_buff *skb, iph->daddr, ntohs(th->dest), iif, sdif); NAPI_GRO_CB(skb)->is_flist =3D !sk; - if (sk) - sock_put(sk); + if (sk) { + if (sk->sk_state =3D=3D TCP_TIME_WAIT) + inet_twsk_put(inet_twsk(sk)); + else + sock_put(sk); + } } =20 INDIRECT_CALLABLE_SCOPE diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c index a45bf17cb2a1..5fcfa45b6f46 100644 --- a/net/ipv6/tcpv6_offload.c +++ b/net/ipv6/tcpv6_offload.c @@ -41,8 +41,12 @@ static void tcp6_check_fraglist_gro(struct list_head *he= ad, struct sk_buff *skb, &hdr->daddr, ntohs(th->dest), iif, sdif); NAPI_GRO_CB(skb)->is_flist =3D !sk; - if (sk) - sock_put(sk); + if (sk) { + if (sk->sk_state =3D=3D TCP_TIME_WAIT) + inet_twsk_put(inet_twsk(sk)); + else + sock_put(sk); + } #endif /* IS_ENABLED(CONFIG_IPV6) */ } =20 --=20 2.45.2