[PATCH] net: smc: fix spurious error message from __sock_release()

[PATCH] net: smc: fix spurious error message from __sock_release()

[Dmitry Antipov]

Commit 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback")
leaves the socket's fasync list pointer within a container socket as well.
When the latter is destroyed, '__sock_release()' warns about its non-empty
fasync list, which is a dangling pointer to previously freed fasync list
of an underlying TCP socket. Fix this spurious warning by nullifying
fasync list of a container socket.

Fixes: 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 net/smc/af_smc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index a2cb30af46cb..0f53a5c6fd9d 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -924,6 +924,7 @@ static int smc_switch_to_fallback(struct smc_sock *smc, int reason_code)
 		smc->clcsock->file->private_data = smc->clcsock;
 		smc->clcsock->wq.fasync_list =
 			smc->sk.sk_socket->wq.fasync_list;
+		smc->sk.sk_socket->wq.fasync_list = NULL;
 
 		/* There might be some wait entries remaining
 		 * in smc sk->sk_wq and they should be woken up
-- 
2.43.0

Re: [PATCH] net: smc: fix spurious error message from __sock_release()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Mon, 12 Feb 2024 17:34:02 +0300 you wrote:
> Commit 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback")
> leaves the socket's fasync list pointer within a container socket as well.
> When the latter is destroyed, '__sock_release()' warns about its non-empty
> fasync list, which is a dangling pointer to previously freed fasync list
> of an underlying TCP socket. Fix this spurious warning by nullifying
> fasync list of a container socket.
> 
> [...]

Here is the summary with links:
  - net: smc: fix spurious error message from __sock_release()
    https://git.kernel.org/netdev/net/c/6cf9ff463317

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH] net: smc: fix spurious error message from __sock_release()

[Wenjia Zhang]

On 12.02.24 15:34, Dmitry Antipov wrote:
> Commit 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback")
> leaves the socket's fasync list pointer within a container socket as well.
> When the latter is destroyed, '__sock_release()' warns about its non-empty
> fasync list, which is a dangling pointer to previously freed fasync list
> of an underlying TCP socket. Fix this spurious warning by nullifying
> fasync list of a container socket.
> 
> Fixes: 67f562e3e147 ("net/smc: transfer fasync_list in case of fallback")
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
I see my antwort is too late...

But I still want to send out my comments:
- please check current MAINTAINERS to put all of the related person in 
your recipient list.
- It looks reasonable to me. I'm curious how you got the warning. By 
using ULP, right?

Thanks,
Wenjia

> ---
>   net/smc/af_smc.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index a2cb30af46cb..0f53a5c6fd9d 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -924,6 +924,7 @@ static int smc_switch_to_fallback(struct smc_sock *smc, int reason_code)
>   		smc->clcsock->file->private_data = smc->clcsock;
>   		smc->clcsock->wq.fasync_list =
>   			smc->sk.sk_socket->wq.fasync_list;
> +		smc->sk.sk_socket->wq.fasync_list = NULL;
>   
>   		/* There might be some wait entries remaining
>   		 * in smc sk->sk_wq and they should be woken up

Re: [PATCH] net: smc: fix spurious error message from __sock_release()

[Dmitry Antipov]

On 2/14/24 18:09, Wenjia Zhang wrote:

> - It looks reasonable to me. I'm curious how you got the warning. By using ULP, right?

This was tracked down from https://syzkaller.appspot.com/bug?extid=5f1acda7e06a2298fae6,
and unfortunately it doesn't fix an actual leak of 'struct fasync_struct' objects. I'm
suspecting an undefined behavior caused by the race condition somewhere around socket
impersonation tricks in 'smc_switch_to_fallback()', and it would be very helpful if an
original authors can take a look as well.

Dmitry