• E
    udp: avoid refcount_t saturation in __udp_gso_segment() · 575b65bc
    Eric Dumazet 提交于
    For some reason, Willem thought that the issue we fixed for TCP
    in commit 7ec318fe ("tcp: gso: avoid refcount_t warning from
    tcp_gso_segment()") was not relevant for UDP GSO.
    
    But syzbot found its way.
    
    refcount_t: saturated; leaking memory.
    WARNING: CPU: 0 PID: 10261 at lib/refcount.c:78 refcount_add_not_zero+0x2d4/0x320 lib/refcount.c:78
    Kernel panic - not syncing: panic_on_warn set ...
    
    CPU: 0 PID: 10261 Comm: syz-executor5 Not tainted 4.17.0-rc3+ #38
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x1b9/0x294 lib/dump_stack.c:113
     panic+0x22f/0x4de kernel/panic.c:184
     __warn.cold.8+0x163/0x1b3 kernel/panic.c:536
     report_bug+0x252/0x2d0 lib/bug.c:186
     fixup_bug arch/x86/kernel/traps.c:178 [inline]
     do_error_trap+0x1de/0x490 arch/x86/kernel/traps.c:296
     do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
     invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
    RIP: 0010:refcount_add_not_zero+0x2d4/0x320 lib/refcount.c:78
    RSP: 0018:ffff880196db6b90 EFLAGS: 00010282
    RAX: 0000000000000026 RBX: 00000000ffffff01 RCX: ffffc900040d9000
    RDX: 0000000000004a29 RSI: ffffffff8160f6f1 RDI: ffff880196db66f0
    RBP: ffff880196db6c78 R08: ffff8801b33d6740 R09: 0000000000000002
    R10: ffff8801b33d6740 R11: 0000000000000000 R12: 0000000000000000
    R13: 00000000ffffffff R14: ffff880196db6c50 R15: 0000000000020101
     refcount_add+0x1b/0x70 lib/refcount.c:102
     __udp_gso_segment+0xaa5/0xee0 net/ipv4/udp_offload.c:272
     udp4_ufo_fragment+0x592/0x7a0 net/ipv4/udp_offload.c:301
     inet_gso_segment+0x639/0x12b0 net/ipv4/af_inet.c:1342
     skb_mac_gso_segment+0x3ad/0x720 net/core/dev.c:2792
     __skb_gso_segment+0x3bb/0x870 net/core/dev.c:2865
     skb_gso_segment include/linux/netdevice.h:4050 [inline]
     validate_xmit_skb+0x54d/0xd90 net/core/dev.c:3122
     __dev_queue_xmit+0xbf8/0x34c0 net/core/dev.c:3579
     dev_queue_xmit+0x17/0x20 net/core/dev.c:3620
     neigh_direct_output+0x15/0x20 net/core/neighbour.c:1401
     neigh_output include/net/neighbour.h:483 [inline]
     ip_finish_output2+0xa5f/0x1840 net/ipv4/ip_output.c:229
     ip_finish_output+0x828/0xf80 net/ipv4/ip_output.c:317
     NF_HOOK_COND include/linux/netfilter.h:277 [inline]
     ip_output+0x21b/0x850 net/ipv4/ip_output.c:405
     dst_output include/net/dst.h:444 [inline]
     ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
     ip_send_skb+0x40/0xe0 net/ipv4/ip_output.c:1434
     udp_send_skb.isra.37+0x5eb/0x1000 net/ipv4/udp.c:825
     udp_push_pending_frames+0x5c/0xf0 net/ipv4/udp.c:853
     udp_v6_push_pending_frames+0x380/0x3e0 net/ipv6/udp.c:1105
     udp_lib_setsockopt+0x59a/0x600 net/ipv4/udp.c:2403
     udpv6_setsockopt+0x95/0xa0 net/ipv6/udp.c:1447
     sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3046
     __sys_setsockopt+0x1bd/0x390 net/socket.c:1903
     __do_sys_setsockopt net/socket.c:1914 [inline]
     __se_sys_setsockopt net/socket.c:1911 [inline]
     __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911
     do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Fixes: ad405857 ("udp: better wmem accounting on gso")
    Signed-off-by: NEric Dumazet <edumazet@google.com>
    Cc: Willem de Bruijn <willemb@google.com>
    Cc: Alexander Duyck <alexander.h.duyck@intel.com>
    Reported-by: Nsyzbot <syzkaller@googlegroups.com>
    Acked-by: NWillem de Bruijn <willemb@google.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    575b65bc
udp_offload.c 12.6 KB