| Message ID | 20250401184501.67377-1-kuniyu@amazon.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | udp: Fix two integer overflows when sk->sk_rcvbuf is close to INT_MAX. | expand |
Hello: This series was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 1 Apr 2025 11:44:41 -0700 you wrote: > I got a report that UDP mem usage in /proc/net/sockstat did not > drop even after an application was terminated. > > The issue could happen if sk->sk_rmem_alloc wraps around due > to a large sk->sk_rcvbuf, which was INT_MAX in our case. > > The patch 2 fixes the issue, and the patch 1 fixes yet another > overflow I found while investigating the issue. > > [...] Here is the summary with links: - [v5,net,1/2] udp: Fix multiple wraparounds of sk->sk_rmem_alloc. https://git.kernel.org/netdev/net/c/5a465a0da13e - [v5,net,2/2] udp: Fix memory accounting leak. https://git.kernel.org/netdev/net/c/df207de9d9e7 You are awesome, thank you!
I got a report that UDP mem usage in /proc/net/sockstat did not drop even after an application was terminated. The issue could happen if sk->sk_rmem_alloc wraps around due to a large sk->sk_rcvbuf, which was INT_MAX in our case. The patch 2 fixes the issue, and the patch 1 fixes yet another overflow I found while investigating the issue. v5: * Drop flaky test * Patch 1 * Update size after skb_condense() v4: * Patch 3 * Wait RCU for at most 30 sec v3: https://lore.kernel.org/netdev/20250327202722.63756-1-kuniyu@amazon.com/ * Rebase * Add Willem's tags v2: https://lore.kernel.org/netdev/20250325195826.52385-1-kuniyu@amazon.com/ * Patch 1 * Define rmem and rcvbuf as unsigned int (Eric) * Take skb->truesize into account for sk with large rcvbuf (Willem) * Patch 3 * Add a comment v1: https://lore.kernel.org/netdev/20250323231016.74813-1-kuniyu@amazon.com/ Kuniyuki Iwashima (2): udp: Fix multiple wraparounds of sk->sk_rmem_alloc. udp: Fix memory accounting leak. net/ipv4/udp.c | 42 ++++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 18 deletions(-)