From: kapandey@codeaurora.org
To: willemb@google.com, pabeni@redhat.com, netdev@vger.kernel.org,
eric.dumazet@gmail.com, sharathv@codeaurora.org,
subashab@codeaurora.org
Subject: Panic in udp4_lib_lookup2
Date: Wed, 12 May 2021 23:51:30 +0530 [thread overview]
Message-ID: <eda8bfc80307abce79df504648c60eae@codeaurora.org> (raw)
Hi All,
We observed panic in udp_lib_lookup with below call trace:
[136523.743271] (7) Call trace:
[136523.743275] (7) udp4_lib_lookup2+0x88/0x1d8
[136523.743277] (7) __udp4_lib_lookup+0x168/0x194
[136523.743280] (7) udp4_lib_lookup+0x28/0x54
[136523.743285] (7) nf_sk_lookup_slow_v4+0x2b4/0x384
[136523.743289] (7) owner_mt+0xb8/0x248
[136523.743292] (7) ipt_do_table+0x28c/0x6a8
[136523.743295] (7) iptable_filter_hook+0x24/0x30
[136523.743299] (7) nf_hook_slow+0xa8/0x148
[136523.743303] (7) ip_local_deliver+0xa8/0x14c
[136523.743305] (7) ip_rcv+0xe0/0x134
We suspect this might happen due to below sequence:
Time CPU X
CPU Y
t0 inet_release -> udp_lib_close ->
sk_common_release -> udp_lib_unhash
inet_diag_handler_cmd -> udp_diag_destroy -> __udp_diag_destroy ->
udp_lib_rehash
t1 if(sk hashed)
if(sk hashed)
sk_del_node_init_rcu
hlist_del_init_rcu(udp_portaddr_node)
t2
if(hslot2 != nhslot2)
hlist_del_init_rcu(udp_portaddr_node)
hlist_add_head_rcu(udp_portaddr_node)
t3 sk is freed here
After t3 any use of that added udp_portaddr_node will cause panic.
Same happens in udp4_lib_lookup2/udp6_lib_lookup2.
We dont have any reproducer for this, getting hit during random testing.
Pls let us know how this be resolved.
Thanks,
KP
next reply other threads:[~2021-05-12 20:13 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-12 18:21 kapandey [this message]
2021-05-13 8:05 ` Panic in udp4_lib_lookup2 Paolo Abeni
2021-05-13 19:48 ` Kaustubh Pandey
2021-05-13 21:18 ` Paolo Abeni
2021-05-18 14:20 ` Kaustubh Pandey
2021-05-21 18:18 ` Paolo Abeni
2021-06-04 14:26 ` Kaustubh Pandey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=eda8bfc80307abce79df504648c60eae@codeaurora.org \
--to=kapandey@codeaurora.org \
--cc=eric.dumazet@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sharathv@codeaurora.org \
--cc=subashab@codeaurora.org \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).