Commit 719395c6 authored May 21, 2022 by John Fastabend Committed by Zheng Zengkai May 21, 2022

bpf, sockmap: Fix memleak on ingress msg enqueue

mainline inclusion
from mainline-v5.13-rc1
commit 9635720b
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I545NW

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9635720b7c88592214562cb72605bdab6708006c



--------------------------------

If backlog handler is running during a tear down operation we may enqueue
data on the ingress msg queue while tear down is trying to free it.

 sk_psock_backlog()
   sk_psock_handle_skb()
     skb_psock_skb_ingress()
       sk_psock_skb_ingress_enqueue()
         sk_psock_queue_msg(psock,msg)
                                           spin_lock(ingress_lock)
                                            sk_psock_zap_ingress()
                                             _sk_psock_purge_ingerss_msg()
                                              _sk_psock_purge_ingress_msg()
                                            -- free ingress_msg list --
                                           spin_unlock(ingress_lock)
           spin_lock(ingress_lock)
           list_add_tail(msg,ingress_msg) <- entry on list with no one
                                             left to free it.
           spin_unlock(ingress_lock)

To fix we only enqueue from backlog if the ENABLED bit is set. The tear
down logic clears the bit with ingress_lock set so we wont enqueue the
msg in the last step.

Fixes: 799aa7f9 ("skmsg: Avoid lock_sock() in sk_psock_backlog()")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210727160500.1713554-4-john.fastabend@gmail.com


Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Reviewed-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>

parent b4da6642

include/linux/skmsg.h

+35 −19

Original line number	Diff line number	Diff line
		@@ -297,11 +297,45 @@ static inline struct sk_psock sk_psock(const struct sock sk)
		return rcu_dereference_sk_user_data(sk);
		}

		static inline void sk_psock_set_state(struct sk_psock *psock,
		enum sk_psock_state_bits bit)
		{
		set_bit(bit, &psock->state);
		}

		static inline void sk_psock_clear_state(struct sk_psock *psock,
		enum sk_psock_state_bits bit)
		{
		clear_bit(bit, &psock->state);
		}

		static inline bool sk_psock_test_state(const struct sk_psock *psock,
		enum sk_psock_state_bits bit)
		{
		return test_bit(bit, &psock->state);
		}

		static inline void sock_drop(struct sock sk, struct sk_buff skb)
		{
		sk_drops_add(sk, skb);
		kfree_skb(skb);
		}

		static inline void drop_sk_msg(struct sk_psock psock, struct sk_msg msg)
		{
		if (msg->skb)
		sock_drop(psock->sk, msg->skb);
		kfree(msg);
		}

		static inline void sk_psock_queue_msg(struct sk_psock *psock,
		struct sk_msg *msg)
		{
		spin_lock_bh(&psock->ingress_lock);
		if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
		list_add_tail(&msg->list, &psock->ingress_msg);
		else
		drop_sk_msg(psock, msg);
		spin_unlock_bh(&psock->ingress_lock);
		}

		@@ -423,24 +457,6 @@ static inline void sk_psock_restore_proto(struct sock *sk,
		}
		}

		static inline void sk_psock_set_state(struct sk_psock *psock,
		enum sk_psock_state_bits bit)
		{
		set_bit(bit, &psock->state);
		}

		static inline void sk_psock_clear_state(struct sk_psock *psock,
		enum sk_psock_state_bits bit)
		{
		clear_bit(bit, &psock->state);
		}

		static inline bool sk_psock_test_state(const struct sk_psock *psock,
		enum sk_psock_state_bits bit)
		{
		return test_bit(bit, &psock->state);
		}

		static inline struct sk_psock sk_psock_get(struct sock sk)
		{
		struct sk_psock *psock;