Wang Yufen wrote:
> If tcp_bpf_sendmsg is running during a tear down operation, psock may be
> freed.
>
> tcp_bpf_sendmsg()
> tcp_bpf_send_verdict()
> sk_msg_return()
> tcp_bpf_sendmsg_redir()
> unlikely(!psock))
> sk_msg_free()
>
> The mem of msg has been uncharged in tcp_bpf_send_verdict() by
> sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock
> is null, we can simply returning an error code, this would then trigger
> the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have
> the side effect of throwing an error up to user space. This would be a
> slight change in behavior from user side but would look the same as an
> error if the redirect on the socket threw an error.
>
> This issue can cause the following info:
> WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
> Call Trace:
> <TASK>
> __sk_destruct+0x24/0x1f0
> sk_psock_destroy+0x19b/0x1c0
> process_one_work+0x1b3/0x3c0
> worker_thread+0x30/0x350
> ? process_one_work+0x3c0/0x3c0
> kthread+0xe6/0x110
> ? kthread_complete_and_exit+0x20/0x20
> ret_from_fork+0x22/0x30
> </TASK>
>
> Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
> Signed-off-by: Wang Yufen <wangyufen@xxxxxxxxxx>
> ---
> net/ipv4/tcp_bpf.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
Thanks John!
Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
