diff options
| author | Martin KaFai Lau <martin.lau@kernel.org> | 2024-01-04 03:34:32 +0300 |
|---|---|---|
| committer | Martin KaFai Lau <martin.lau@kernel.org> | 2024-01-04 03:50:24 +0300 |
| commit | 417fa6d163df6f13fb2cfad5132eff354c8a472e (patch) | |
| tree | d8a0d5f195e29edc68c8095a224b082f57ef2dfc /include | |
| parent | b4560055c8f11c5e2cfffb4de928b3cfd4eae3b4 (diff) | |
| parent | bdbca46d3f84a4455cd5c15a7483666218851549 (diff) | |
| download | linux-417fa6d163df6f13fb2cfad5132eff354c8a472e.tar.xz | |
Merge branch 'fix sockmap + stream af_unix memleak'
John Fastabend says:
====================
There was a memleak when streaming af_unix sockets were inserted into
multiple sockmap slots and/or maps. This is because each insert would
call a proto update operatino and these must be allowed to be called
multiple times. The streaming af_unix implementation recently added
a refcnt to handle a use after free issue, however it introduced a
memleak when inserted into multiple maps.
This series fixes the memleak, adds a note in the code so we remember
that proto updates need to support this. And then we add three tests
for each of the slightly different iterations of adding sockets into
multiple maps. I kept them as 3 independent test cases here. I have
some slight preference for this they could however be a single test,
but then you don't get to run them independently which was sort of
useful while debugging.
====================
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/skmsg.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index c953b8c0d2f4..888a4b217829 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -100,6 +100,11 @@ struct sk_psock { void (*saved_close)(struct sock *sk, long timeout); void (*saved_write_space)(struct sock *sk); void (*saved_data_ready)(struct sock *sk); + /* psock_update_sk_prot may be called with restore=false many times + * so the handler must be safe for this case. It will be called + * exactly once with restore=true when the psock is being destroyed + * and psock refcnt is zero, but before an RCU grace period. + */ int (*psock_update_sk_prot)(struct sock *sk, struct sk_psock *psock, bool restore); struct proto *sk_proto; |
