On May 7, 2023, at 6:32 PM, Ding Hui <dinghui@xxxxxxxxxxxxxx> wrote:
On 2023/5/7 23:26, Chuck Lever III wrote:
On May 7, 2023, at 5:11 AM, Ding Hui <dinghui@xxxxxxxxxxxxxx> wrote:My thought is that not calling sk_odata() for the newsock
After the listener svc_sock freed, and before invoking svc_tcp_accept()
for the established child sock, there is a window that the newsock
retaining a freed listener svc_sock in sk_user_data which cloning from
parent. In the race windows if data is received on the newsock, we will
observe use-after-free report in svc_tcp_listen_data_ready().
could potentially result in missing a data_ready event,
resulting in a hung client on that socket.
I checked the vmcore, found that sk_odata points to sock_def_readable(),
and the sk_wq of newsock is NULL, which be assigned by sk_clone_lock()
unconditionally.
Calling sk_odata() for the newsock maybe do not wake up any sleepers.
IMO the preferred approach is to ensure that svsk is always
safe to dereference in tcp_listen_data_ready. I haven't yet
thought carefully about how to do that.
Agree, but I don't have a good way for now.
Would a smartly-placed svc_xprt_get() hold the listener in place
until accept processing completes?
Reproduce by two tasks:
...