Eric Dumazet
c8c1eec578
net: stream: purge sk_error_queue in sk_stream_kill_queues() ...
[ Upstream commit e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3 ]
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
2) If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the cloned skbs are still in sk_error_queue,
socket refcount is kept elevated.
3) Application closes the socket, while error queue is not empty.
Since tcp_close() no longer purges the socket error queue,
we might end up with a TCP socket with at least one skb in
error queue keeping the socket alive forever.
This bug can be (ab)used to consume all kernel memory
and freeze the host.
We need to purge the error queue, with proper synchronization
against concurrent writers.
Fixes: 24bcbe1cc69f ("net: stream: don't purge sk_error_queue in sk_stream_kill_queues()")
Reported-by: Changheon Lee <darklight2357@icloud.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-07 12:07:30 +01:00
6lowpan: Off by one handling ->nexthdr
2020-01-29 10:24:22 +01:00
net/9p: Fix a potential socket leak in p9_socket_open
2022-12-08 11:15:41 +01:00
net/802/garp: fix memleak in garp_request_join()
2021-08-04 11:58:02 +02:00
vlan: fix memory leak in vlan_dev_set_egress_priority
2020-01-12 11:24:27 +01:00
appletalk: Fix skb allocation size in loopback case
2021-04-07 12:05:39 +02:00
net/atm: fix proc_mpc_write incorrect return value
2022-11-03 23:49:15 +09:00
ax25: Fix NULL pointer dereference in ax25_kill_by_device
2022-03-16 12:49:00 +01:00
batman-adv: Don't expect inter-netns unique iflink indices
2022-03-16 12:49:01 +01:00
Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
2023-01-07 12:07:23 +01:00
netfilter: br_netfilter: Drop dst references before setting.
2022-09-15 12:39:46 +02:00
net: caif: fix double disconnect client in chnl_net_open()
2022-11-25 17:35:39 +01:00
can: bcm: check the result of can_send() in bcm_can_tx()
2022-10-26 13:15:46 +02:00
libceph: clear con->out_msg on Policy::stateful_server faults
2020-11-10 10:23:59 +01:00
net: stream: purge sk_error_queue in sk_stream_kill_queues()
2023-01-07 12:07:30 +01:00
net: dcb: disable softirqs in dcbnl_flush_dev()
2022-03-08 19:00:59 +01:00
dccp: don't duplicate ccid when cloning dccp sock
2021-09-22 11:43:09 +02:00
net: decnet: Fix sleeping inside in af_decnet
2021-07-28 09:14:27 +02:00
KEYS: DNS: fix parsing multiple options
2018-07-22 14:27:39 +02:00
net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
2020-04-13 10:32:53 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
net: hsr: Fix potential use-after-free
2022-12-08 11:15:41 +01:00
net: ieee802154: fix error return code in dgram_bind()
2022-11-03 23:49:17 +09:00
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
2023-01-07 12:07:21 +01:00
tcp/udp: Fix memory leak in ipv6_renew_options().
2022-12-08 11:15:42 +01:00
ipx: call ipxitf_put() in ioctl error path
2017-05-25 15:44:41 +02:00
irda: Only insert new objects into the global database via setsockopt
2018-09-15 09:43:01 +02:00
net/af_iucv: set correct sk_protocol for child sockets
2020-12-11 13:37:56 +01:00
kcm: avoid potential race in kcm_tx_work
2022-11-25 17:35:42 +01:00
af_key: Fix send_acquire race with pfkey_register
2022-12-08 11:15:39 +01:00
l2tp: fix race in pppol2tp_release with session object destroy
2022-06-25 11:45:19 +02:00
net: lapb: Copy the skb before sending a packet
2021-02-10 09:09:25 +01:00
llc: only change llc->dev when bind() succeeds
2022-03-28 08:06:06 +02:00
wifi: mac80211: Fix ack frame idr leak when mesh has no route
2022-12-08 11:15:39 +01:00
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
2022-12-14 11:24:34 +01:00
net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
2021-03-17 16:10:13 +01:00
net/ncsi: Use real net-device for response handler
2021-01-12 19:49:01 +01:00
ipvs: use explicitly signed chars
2022-11-10 15:46:05 +01:00
cipso,calipso: resolve a number of problems with the DOI refcounts
2022-01-27 08:47:42 +01:00
netlink: do not reset transport header in netlink_recvmsg()
2022-05-18 09:15:43 +02:00
netrom: Decrease sock refcount when sock timers expire
2021-07-28 09:14:27 +02:00
NFC: nci: Bounds check struct nfc_target arrays
2022-12-14 11:24:34 +01:00
openvswitch: Fix flow lookup to use unmasked key
2023-01-07 12:07:29 +01:00
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
2022-12-08 11:15:41 +01:00
phonet: refcount leak in pep_sock_accep
2022-01-11 13:38:12 +01:00
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
2021-03-30 14:41:42 +02:00
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
2022-10-26 13:15:40 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 11:24:23 +01:00
rose: Fix NULL pointer dereference in rose_send_frame()
2022-11-10 15:46:05 +01:00
rxrpc: Don't try to resend the request if we're receiving the reply
2022-06-14 16:52:33 +02:00
net_sched: reject TCF_EM_SIMPLE case for complex ematch module
2023-01-07 12:07:30 +01:00
sctp: read sk->sk_bound_dev_if once in sctp_rcv()
2022-06-14 16:52:32 +02:00
strparser: Fix incorrect strp->need_bytes value.
2018-04-29 11:32:02 +02:00
SUNRPC: Fix missing release socket in rpc_sockname()
2023-01-07 12:07:19 +01:00
tipc: Fix potential OOB in tipc_link_proto_rcv()
2022-12-14 11:24:35 +01:00
af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
2022-01-27 08:47:41 +01:00
net: vmw_vsock: vmci: Check memcpy_from_msg()
2023-01-07 12:07:21 +01:00
wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
2022-09-15 12:39:44 +02:00
net/x25: Fix skb leak in x25_lapb_receive_frame()
2022-11-25 17:35:40 +01:00
xfrm: Update ipcomp_scratches with NULL when freed
2022-10-26 13:15:45 +02:00
net: Return the correct errno code
2021-06-30 08:49:12 -04:00
net: split out functions related to registering inflight socket files
2021-08-04 11:58:01 +02:00
net: Fix a data-race around sysctl_somaxconn.
2022-09-05 10:23:55 +02:00
c8c1eec578