| Message ID | 20250325195826.52385-1-kuniyu@amazon.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | udp: Fix two integer overflows when sk->sk_rcvbuf is close to INT_MAX. | expand |
On Tue, 25 Mar 2025 12:58:12 -0700 Kuniyuki Iwashima wrote: > I got a report that UDP mem usage in /proc/net/sockstat did not > drop even after an application was terminated. > > The issue could happen if sk->sk_rmem_alloc wraps around due > to a large sk->sk_rcvbuf, which was INT_MAX in our case. > > The patch 2 fixes the issue, and the patch 1 fixes yet another > overflow I found while investigating the issue. Selftest doesn't apply after the net-next PR :(
From: Jakub Kicinski <kuba@kernel.org> Date: Thu, 27 Mar 2025 12:51:19 -0700 > On Tue, 25 Mar 2025 12:58:12 -0700 Kuniyuki Iwashima wrote: > > I got a report that UDP mem usage in /proc/net/sockstat did not > > drop even after an application was terminated. > > > > The issue could happen if sk->sk_rmem_alloc wraps around due > > to a large sk->sk_rcvbuf, which was INT_MAX in our case. > > > > The patch 2 fixes the issue, and the patch 1 fixes yet another > > overflow I found while investigating the issue. > > Selftest doesn't apply after the net-next PR :( Will send v3 shortly with so_rcv_listener sorted. Thanks!
I got a report that UDP mem usage in /proc/net/sockstat did not drop even after an application was terminated. The issue could happen if sk->sk_rmem_alloc wraps around due to a large sk->sk_rcvbuf, which was INT_MAX in our case. The patch 2 fixes the issue, and the patch 1 fixes yet another overflow I found while investigating the issue. v2: * Patch 1 * Define rmem and rcvbuf as unsigned int (Eric) * Take skb->truesize into account for sk with large rcvbuf (Willem) * Patch 3 * Add a comment v1: https://lore.kernel.org/netdev/20250323231016.74813-1-kuniyu@amazon.com/ Kuniyuki Iwashima (3): udp: Fix multiple wraparounds of sk->sk_rmem_alloc. udp: Fix memory accounting leak. selftest: net: Check wraparounds for sk->sk_rmem_alloc. net/ipv4/udp.c | 40 +++--- tools/testing/selftests/net/.gitignore | 1 + tools/testing/selftests/net/Makefile | 2 +- tools/testing/selftests/net/so_rcvbuf.c | 181 ++++++++++++++++++++++++ 4 files changed, 206 insertions(+), 18 deletions(-) create mode 100644 tools/testing/selftests/net/so_rcvbuf.c