Re: [RFC net] net: stream: don't purge sk_error_queue without holding its lock
From: Eric Dumazet <hidden>
Date: 2021-09-14 05:14:05
On 9/13/21 3:38 PM, Jakub Kicinski wrote:
quoted hunk ↗ jump to hunk
sk_stream_kill_queues() can be called when there are still outstanding skbs to transmit. Those skbs may try to queue notifications to the error queue (e.g. timestamps). If sk_stream_kill_queues() purges the queue without taking its lock the queue may get corrupted. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- Sending as an RFC for review, compile-tested only. Seems far more likely that I'm missing something than that this has been broken forever and nobody noticed :S --- net/core/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/net/core/stream.c b/net/core/stream.c index 4f1d4aa5fb38..7c585088f394 100644 --- a/net/core/stream.c +++ b/net/core/stream.c@@ -196,7 +196,7 @@ void sk_stream_kill_queues(struct sock *sk) __skb_queue_purge(&sk->sk_receive_queue); /* Next, the error queue. */ - __skb_queue_purge(&sk->sk_error_queue); + skb_queue_purge(&sk->sk_error_queue); /* Next, the write queue. */ WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
This should not be needed. By definition, sk_stream_kill_queues() is only called when there is no more references on the sockets. So all outstanding packets must have been orphaned or freed. Anyway, Linux-2.6.12-rc2 had no timestamps yet.