Fix two bugs in bpf_sock_destroy(). One is an out-of-bounds read of sk->sk_protocol on TIME_WAIT and NEW_SYN_RECV socks, since the field is not in struct sock_common. The other is a might_sleep splat when destroying a listener with children in its accept queue, the cond_resched() in inet_csk_listen_stop() runs under the iterator's rcu_read_lock(). Patch 3 adds a subtest for each.
v2 -> v3: - Patch 1: add Reviewed-by from Kuniyuki. - Patch 2: reword why cond_resched() has to go, it can reschedule or report a bogus quiescent state there. - Patch 2: keep the cond_resched() for the non-BPF path rather than removing it as Kuniyuki suggested. VOLUNTARY and NONE are still there on some arches, and on x86 in stable where this goes, so a big listener close() still relies on it. Can go once those modes are gone. - Selftest: don't leak the fd if accept() unexpectedly succeeds. v2: https://lore.kernel.org/bpf/[email protected]/ v1 -> v2: - Patch 1: fix the return comment too. - Patch 2: new. - Selftest: server recv()s EOF before close so the FINs can't cross, comment style, keep the blank line before RUN_TESTS(), add the tcp_listen_pending subtest. v1: https://lore.kernel.org/bpf/[email protected]/ Jiayuan Chen (3): bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context selftests/bpf: Test bpf_sock_destroy() on TIME_WAIT and listener socks net/core/filter.c | 13 +- net/ipv4/inet_connection_sock.c | 3 +- .../selftests/bpf/prog_tests/sock_destroy.c | 121 ++++++++++++++++++ .../selftests/bpf/progs/sock_destroy_prog.c | 30 +++++ 4 files changed, 162 insertions(+), 5 deletions(-) -- 2.43.0
