Re: [syzbot] [net?] INFO: task hung in unix_dgram_sendmsg

[Kuniyuki Iwashima]

From: syzbot <syzbot+4fa4a2d1f5a5ee06f006@xxxxxxxxxxxxxxxxxxxxxxxxx>
Date: Fri, 09 Feb 2024 11:02:22 -0800
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    1f719a2f3fa6 Merge tag 'net-6.8-rc4' of git://git.kernel.o..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16a21d04180000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=53985487b59d9442
> dashboard link: https://syzkaller.appspot.com/bug?extid=4fa4a2d1f5a5ee06f006
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1636f042180000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=141c0cec180000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/b8bd7b1c1c4d/disk-1f719a2f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/58ee6966cdfc/vmlinux-1f719a2f.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/3de15662a476/bzImage-1f719a2f.xz
> 
> The issue was bisected to:
> 
> commit 1279f9d9dec2d7462823a18c29ad61359e0a007d
> Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
> Date:   Sat Feb 3 18:31:49 2024 +0000
> 
>     af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=17e71d7c180000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=14171d7c180000
> console output: https://syzkaller.appspot.com/x/log.txt?x=10171d7c180000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+4fa4a2d1f5a5ee06f006@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 1279f9d9dec2 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.")

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 1279f9d9dec2d7462823a18c29ad61359e0a007d

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 3e4b986de94b..51acf795f096 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -340,10 +340,11 @@ static void __unix_gc(struct work_struct *work)
 	__skb_queue_purge(&hitlist);
 
 #if IS_ENABLED(CONFIG_AF_UNIX_OOB)
-	list_for_each_entry_safe(u, next, &gc_candidates, link) {
-		struct sk_buff *skb = u->oob_skb;
+	while (!list_empty(&gc_candidates)) {
+		u = list_entry(gc_candidates.next, struct unix_sock, link);
+		if (u->oob_skb) {
+			struct sk_buff *skb = u->oob_skb;
 
-		if (skb) {
 			u->oob_skb = NULL;
 			kfree_skb(skb);
 		}