Re: GPF in net sybsystem
From: Jakub Kicinski <kuba@kernel.org>
Date: 2021-05-06 22:09:35
Also in:
lkml
On Wed, 5 May 2021 20:02:42 +0300 Pavel Skripkin wrote:
Hi, netdev developers! I've spent some time debugging this bug https://syzkaller.appspot.com/bug?id=c670fb9da2ce08f7b5101baa9426083b39ee9f90 and, I believe, I found the root case: static int nr_accept(struct socket *sock, struct socket *newsock, int flags, bool kern) { .... for (;;) { prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); ... if (!signal_pending(current)) { release_sock(sk); schedule(); lock_sock(sk); continue; } ... } ... } When calling process will be scheduled, another proccess can release this socket and set sk->sk_wq to NULL. (In this case nr_release() will call sock_orphan(sk)). In this case GPF will happen in prepare_to_wait().
How does it get released midway through an accept call? Is there a reference imbalance somewhere else in the code?
quoted hunk ↗ jump to hunk
I came up with this patch, but im not an expect in netdev sybsystem and im not sure about this one:diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 6d16e1ab1a8a..89ceddea48e8 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c@@ -803,6 +803,10 @@ static int nr_accept(struct socket *sock, struct socket *newsock, int flags, release_sock(sk); schedule(); lock_sock(sk); + if (sock_flag(sk, SOCK_DEAD)) { + err = -ECONNABORTED; + goto out_release; + } continue; } err = -ERESTARTSYS;I look forward to hearing your perspective on this :) BTW, I found similar code in: 1) net/ax25/af_ax25.c 2) net/rose/af_rose.c I hope, this will help! With regards, Pavel Skripkin