Re: [PATCH backport 5.10.y] bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Jul 03, 2024 at 11:47:46AM +0800, Wen Gu wrote:
> From: Wang Yufen <wangyufen@huawei.com>
> 
> [ Upstream commit d8616ee2affcff37c5d315310da557a694a3303d ]
> 
> During TCP sockmap redirect pressure test, the following warning is triggered:
> 
> WARNING: CPU: 3 PID: 2145 at net/core/stream.c:205 sk_stream_kill_queues+0xbc/0xd0
> CPU: 3 PID: 2145 Comm: iperf Kdump: loaded Tainted: G        W         5.10.0+ #9
> Call Trace:
>  inet_csk_destroy_sock+0x55/0x110
>  inet_csk_listen_stop+0xbb/0x380
>  tcp_close+0x41b/0x480
>  inet_release+0x42/0x80
>  __sock_release+0x3d/0xa0
>  sock_close+0x11/0x20
>  __fput+0x9d/0x240
>  task_work_run+0x62/0x90
>  exit_to_user_mode_prepare+0x110/0x120
>  syscall_exit_to_user_mode+0x27/0x190
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> The reason we observed is that:
> 
> When the listener is closing, a connection may have completed the three-way
> handshake but not accepted, and the client has sent some packets. The child
> sks in accept queue release by inet_child_forget()->inet_csk_destroy_sock(),
> but psocks of child sks have not released.
> 
> To fix, add sock_map_destroy to release psocks.
> 
> Signed-off-by: Wang Yufen <wangyufen@huawei.com>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
> Acked-by: John Fastabend <john.fastabend@gmail.com>
> Link: https://lore.kernel.org/bpf/20220524075311.649153-1-wangyufen@huawei.com
> Stable-dep-of: 8bbabb3fddcd ("bpf, sock_map: Move cancel_work_sync() out of sock lock")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> [Conflict in include/linux/bpf.h due to function declaration position
> and remove non-existed sk_psock_stop helper from sock_map_destroy.]
> Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
> ---
> background:
> Link: https://lore.kernel.org/stable/d11bc7e6-a2c7-445a-8561-3599eafb07b0@linux.alibaba.com/
> 
> @stable team:
> This backport has 2 changes compared to the original patch:
> - fix conflict due to sock_map_destroy declaration position in include/linux/bpf.h;
> - remove the non-existed sk_psock_stop helper from sock_map_destroy. This helper is
>   introduced by 799aa7f98d53 ("skmsg: Avoid lock_sock() in sk_psock_backlog()") after
>   v5.10, it is not a fix and hard to backport. Considering that what did in
>   sk_psock_stop is done in sk_psock_drop and neither sock_map_close nor sock_map_unhash
>   in v5.10 introduces sk_psock_stop, I removed it from sock_map_destroy too.
> I tested it in my environment, the regression was gone.

Now queued up, thanks.

greg k-h