Paolo Abeni eaeef1ce55 mptcp: fix memory accounting on allocation error ... In case of memory pressure the MPTCP xmit path keeps at most a single skb in the tx cache, eventually freeing additional ones. The associated counter for forward memory is not update accordingly, and that causes the following splat: WARNING: CPU: 0 PID: 12 at net/core/stream.c:208 sk_stream_kill_queues+0x3ca/0x530 net/core/stream.c:208 Modules linked in: CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.11.0-rc2 #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:sk_stream_kill_queues+0x3ca/0x530 net/core/stream.c:208 Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 63 01 00 00 8b ab 00 01 00 00 e9 60 ff ff ff e8 2f 24 d3 fe 0f 0b eb 97 e8 26 24 d3 fe <0f> 0b eb a0 e8 1d 24 d3 fe 0f 0b e9 a5 fe ff ff 4c 89 e7 e8 0e d0 RSP: 0018:ffffc900000c7bc8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88810030ac40 RSI: ffffffff8262ca4a RDI: 0000000000000003 RBP: 0000000000000d00 R08: 0000000000000000 R09: ffffffff85095aa7 R10: ffffffff8262c9ea R11: 0000000000000001 R12: ffff888108908100 R13: ffffffff85095aa0 R14: ffffc900000c7c48 R15: 1ffff92000018f85 FS: 0000000000000000(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa7444baef8 CR3: 0000000035ee9005 CR4: 0000000000170ef0 Call Trace: __mptcp_destroy_sock+0x4a7/0x6c0 net/mptcp/protocol.c:2547 mptcp_worker+0x7dd/0x1610 net/mptcp/protocol.c:2272 process_one_work+0x896/0x1170 kernel/workqueue.c:2275 worker_thread+0x605/0x1350 kernel/workqueue.c:2421 kthread+0x344/0x410 kernel/kthread.c:292 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:296 At close time, as reported by syzkaller/Christoph. This change address the issue properly updating the fwd allocated memory counter in the error path. Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/136 Fixes: 724cfd2ee8 ("mptcp: allocate TX skbs in msk context") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-03-04 14:30:13 -08:00
..
6lowpan
9p	net: 9p: advance iov on empty read	2021-03-03 16:57:59 -08:00
802
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-14 18:34:50 -08:00
appletalk	appletalk: Fix skb allocation size in loopback case	2021-02-12 16:40:28 -08:00
atm	net: atm: pppoatm: use new API for wakeup tasklet	2021-01-29 18:24:05 -08:00
ax25
batman-adv	This feature/cleanup patchset is an updated version of the pull request	2021-02-08 11:32:40 -08:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kern	2021-02-11 14:59:01 -08:00
bpf	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-01-20 12:16:11 -08:00
bpfilter	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
bridge	bridge: mrp: Update br_mrp to use new return values of br_mrp_switchdev	2021-02-16 14:47:46 -08:00
caif	net: caif: Use netif_rx_any_context().	2021-02-15 13:21:48 -08:00
can	net: introduce CAN specific pointer in the struct net_device	2021-02-24 14:32:15 -08:00
ceph	libceph: remove osdtimeout option entirely	2021-02-16 12:09:52 +01:00
core	rtnetlink: using dev_base_seq from target net	2021-03-03 16:59:17 -08:00
dcb	net: dcb: use obj-$(CONFIG_DCB) form in net/Makefile	2021-01-27 17:03:52 -08:00
dccp	dccp: Return the correct errno code	2021-02-06 11:15:28 -08:00
decnet	net: decnet: fix netdev refcount leaking on error path	2021-01-27 17:33:46 -08:00
dns_resolver	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
dsa	net: dsa: tag_mtk: fix 802.1ad VLAN egress	2021-03-01 15:29:43 -08:00
ethernet	net: datagram: fix some kernel-doc markups	2020-11-17 14:15:03 -08:00
ethtool	ethtool: fix the check logic of at least one channel for RX/TX	2021-02-28 11:49:07 -08:00
hsr	net: hsr: add support for EntryForgetTime	2021-02-25 09:41:51 -08:00
ieee802154	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
ife	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
ipv4	nexthop: Do not flush blackhole nexthops when loopback goes down	2021-03-04 14:04:49 -08:00
ipv6	net: always use icmp{,v6}_ndo_send from ndo_start_xmit	2021-03-01 13:11:35 -08:00
iucv	net/af_iucv: build SG skbs for TRANS_HIPER sockets	2021-01-28 20:36:22 -08:00
kcm	net: group skb_shinfo zerocopy related bits together.	2021-01-07 16:08:37 -08:00
key	af_key: relax availability checks for skb size calculation	2021-01-04 10:05:50 +01:00
l2tp	net: l2tp: reduce log level of messages in receive path, add counter instead	2021-03-03 16:55:02 -08:00
l3mdev	net: l3mdev: use obj-$(CONFIG_NET_L3_MASTER_DEV) form in net/Makefile	2021-01-27 17:03:52 -08:00
lapb	net: lapb: Copy the skb before sending a packet	2021-02-02 08:40:48 -08:00
llc	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
mac80211	cfg80211/mac80211: Support disabling HE mode	2021-02-12 09:33:34 +01:00
mac802154	net: mac802154: convert tasklets to use new tasklet_setup() API	2020-11-07 10:40:56 -08:00
mpls	mpls: drop skb's dst in mpls_forward()	2020-11-03 12:55:53 -08:00
mptcp	mptcp: fix memory accounting on allocation error	2021-03-04 14:30:13 -08:00
ncsi	net/ncsi: Use real net-device for response handler	2020-12-23 12:22:23 -08:00
netfilter	netfilter: nftables: introduce table ownership	2021-02-15 18:17:15 +01:00
netlabel	Merge https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-11-19 19:08:46 -08:00
netlink	mptcp: avoid lock_fast usage in accept path	2021-02-12 16:31:46 -08:00
netrom
nfc	TTY/Serial driver changes for 5.12-rc1	2021-02-20 21:28:04 -08:00
nsh
openvswitch	net: openvswitch: add log message for error case	2021-01-14 16:32:14 -08:00
packet	net/packet: Improve the comment about LL header visibility criteria	2021-02-06 14:59:28 -08:00
phonet
psample	net: psample: Fix netlink skb length with tunnel info	2021-02-25 09:49:46 -08:00
qrtr	net/qrtr: fix __netdev_alloc_skb call	2021-03-01 13:24:03 -08:00
rds	net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS	2021-02-02 08:44:08 -08:00
rfkill	rfkill: add a reason to the HW rfkill state	2020-12-11 12:47:17 +01:00
rose	rose: Fix Null pointer dereference in rose_send_frame()	2020-11-20 10:04:58 -08:00
rxrpc	rxrpc: Fix dependency on IPv6 in udp tunnel config	2021-02-12 16:42:05 -08:00
sched	net: sched: avoid duplicates in classes dump	2021-03-04 14:27:47 -08:00
sctp	net: sctp: trivial: fix typo in comment	2021-03-04 13:48:32 -08:00
smc	net/smc: use memcpy instead of snprintf to avoid out of bounds read	2021-01-12 20:22:01 -08:00
strparser
sunrpc	Optimization:	2021-02-22 13:29:55 -08:00
switchdev	net: bridge: propagate extack through switchdev_port_attr_set	2021-02-14 17:38:11 -08:00
tipc	tipc: remove duplicated code in tipc_msg_create	2021-01-27 18:50:07 -08:00
tls	net/tls: Select SOCK_RX_QUEUE_MAPPING from TLS_DEVICE	2021-02-11 19:08:06 -08:00
unix	af_unix: handle idmapped mounts	2021-01-24 14:27:18 +01:00
vmw_vsock	vsock: fix locking in vsock_shutdown()	2021-02-09 15:31:22 -08:00
wireless	cfg80211/mac80211: Support disabling HE mode	2021-02-12 09:33:34 +01:00
x25	net: x25: Remove unimplemented X.25-over-LLC code stubs	2020-12-12 17:15:33 -08:00
xdp	xsk: Fold xp_assign_dev and __xp_assign_dev	2021-01-25 23:56:33 +01:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2021-02-09 11:23:41 -08:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c
Kconfig	net/sock: Add kernel config SOCK_RX_QUEUE_MAPPING	2021-02-11 19:08:06 -08:00
Makefile	net: l3mdev: use obj-$(CONFIG_NET_L3_MASTER_DEV) form in net/Makefile	2021-01-27 17:03:52 -08:00
socket.c	idmapped-mounts-v5.12	2021-02-23 13:39:45 -08:00
sysctl_net.c