[PATCH net] rxrpc: Fix deadlock around release of dst cached on udp tunnel
Vadim Fedorenko
vfedorenko at novek.ru
Fri Jan 29 12:30:21 EST 2021
On 29.01.2021 16:44, David Howells wrote:
> AF_RXRPC sockets use UDP ports in encap mode. This causes socket and dst
> from an incoming packet to get stolen and attached to the UDP socket from
> whence it is leaked when that socket is closed.
>
> When a network namespace is removed, the wait for dst records to be cleaned
> up happens before the cleanup of the rxrpc and UDP socket, meaning that the
> wait never finishes.
>
> Fix this by moving the rxrpc (and, by dependence, the afs) private
> per-network namespace registrations to the device group rather than subsys
> group. This allows cached rxrpc local endpoints to be cleared and their
> UDP sockets closed before we try waiting for the dst records.
>
> The symptom is that lines looking like the following:
>
> unregister_netdevice: waiting for lo to become free
>
> get emitted at regular intervals after running something like the
> referenced syzbot test.
>
> Thanks to Vadim for tracking this down and work out the fix.
You missed the call to dst_release(sk->sk_rx_dst) in rxrpc_sock_destructor.
Without it we are still leaking the dst.
More information about the linux-afs
mailing list