On Wed, Mar 1, 2017 at 1:54 PM, Eric Dumazet <eduma...@google.com> wrote: > On Wed, Mar 1, 2017 at 1:43 PM, Cong Wang <xiyou.wangc...@gmail.com> wrote: >>> >>> This one looks very similar to a previous one: >>> https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ >>> >>> Both happen on raw v6 sockets. >>> >>> For me, it seems the sk refcnt is not correct, skb should still hold >>> a refcnt so it should not be freed before kfree_skb() in a timer >>> handler... >> >> More precisely, after this commit: >> >> commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 >> Author: Eric Dumazet <eric.duma...@gmail.com> >> Date: Thu Jun 11 02:55:43 2009 -0700 >> >> net: No more expensive sock_hold()/sock_put() on each tx >> >> we don't take (old) refcnt any more on TX path, sk_wmem_alloc >> is the new refcnt. ;) > > So the bug is that skb->truesize is mangled by reassembly unit, > while sbk->sk is tracking sk_wmem_alloc changes in order > to decide when it is safe to free sk.
That is my suspicion as well, skb->truesize is updated somewhere but sk->sk_wmem_alloc isn't, so leads to this bug. > > This is why we need to call skb_orphan(), as we did for IPv4 in > 8282f27449bf15548 But I doubt skb_orphan() is the solution here, shouldn't we just update sk->sk_wmem_alloc with skb->truesize changes?