syzkaller reported an warning of netns ref tracker for RDS TCP listener,
which commit 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in
inet_twsk_purge()") partially fixed.
This series fixes the bug in the partial fix, reverts the partial fix,
and fixes the root cause on the RDS side.
Changes:
v2:
* Add patch 1, 3, 5
* Use __sock_create() instead of converting socket
* Drop Sowmini from CC as it's bounced (patchwork may complain)
v1: https://lore.kernel.org/netdev/20240223172448.94084-1-kuniyu@xxxxxxxxxx/
Kuniyuki Iwashima (5):
tcp: Restart iteration after removing reqsk in inet_twsk_purge().
Revert "tcp: Clean up kernel listener's reqsk in inet_twsk_purge()"
net: Convert @kern of __sock_create() to enum.
rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
tcp: Add assertion for reqsk->rsk_listener->sk_net_refcnt.
include/linux/net.h | 6 ++++++
net/core/sock.c | 2 +-
net/ipv4/inet_timewait_sock.c | 14 +-------------
net/ipv4/tcp_input.c | 2 ++
net/ipv4/tcp_minisocks.c | 9 ++++-----
net/rds/tcp_listen.c | 4 ++--
net/socket.c | 11 ++++++-----
7 files changed, 22 insertions(+), 26 deletions(-)
--
2.30.2
