On 07.11.2024 23:46, Michal Luczaj wrote:
> Kernel queues MSG_ZEROCOPY completion notifications on the error queue.
> Where they remain, until explicitly recv()ed. To prevent memory leaks,
> clean up the queue when the socket is destroyed.
>
> unreferenced object 0xffff8881028beb00 (size 224):
> comm "vsock_test", pid 1218, jiffies 4294694897
> hex dump (first 32 bytes):
> 90 b0 21 17 81 88 ff ff 90 b0 21 17 81 88 ff ff ..!.......!.....
> 00 00 00 00 00 00 00 00 00 b0 21 17 81 88 ff ff ..........!.....
> backtrace (crc 6c7031ca):
> [<ffffffff81418ef7>] kmem_cache_alloc_node_noprof+0x2f7/0x370
> [<ffffffff81d35882>] __alloc_skb+0x132/0x180
> [<ffffffff81d2d32b>] sock_omalloc+0x4b/0x80
> [<ffffffff81d3a8ae>] msg_zerocopy_realloc+0x9e/0x240
> [<ffffffff81fe5cb2>] virtio_transport_send_pkt_info+0x412/0x4c0
> [<ffffffff81fe6183>] virtio_transport_stream_enqueue+0x43/0x50
> [<ffffffff81fe0813>] vsock_connectible_sendmsg+0x373/0x450
> [<ffffffff81d233d5>] ____sys_sendmsg+0x365/0x3a0
> [<ffffffff81d246f4>] ___sys_sendmsg+0x84/0xd0
> [<ffffffff81d26f47>] __sys_sendmsg+0x47/0x80
> [<ffffffff820d3df3>] do_syscall_64+0x93/0x180
> [<ffffffff8220012b>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support")
> Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
> ---
> net/vmw_vsock/af_vsock.c | 3 +++
> 1 file changed, 3 insertions(+)
Acked-by: Arseniy Krasnov <avkrasnov@xxxxxxxxxxxxxxxxx>
>
> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 35681adedd9aaec3565495158f5342b8aa76c9bc..dfd29160fe11c4675f872c1ee123d65b2da0dae6 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
> @@ -836,6 +836,9 @@ static void vsock_sk_destruct(struct sock *sk)
> {
> struct vsock_sock *vsk = vsock_sk(sk);
>
> + /* Flush MSG_ZEROCOPY leftovers. */
> + __skb_queue_purge(&sk->sk_error_queue);
> +
> vsock_deassign_transport(vsk);
>
> /* When clearing these addresses, there's no need to set the family and
>
