Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 28 Jun 2021 16:41:26 -0700
From:   Martin KaFai Lau <kafai@fb.com>
To:     Phi Nguyen <phind.uet@gmail.com>
CC:     Neal Cardwell <ncardwell@google.com>,
        Eric Dumazet <edumazet@google.com>,
        David Miller <davem@davemloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        David Ahern <dsahern@kernel.org>,
        Jakub Kicinski <kuba@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Song Liu <songliubraving@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        <kpsingh@kernel.org>, netdev <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>, bpf <bpf@vger.kernel.org>,
        <linux-kernel-mentees@lists.linuxfoundation.org>,
        <syzbot+f1e24a0594d4e3a895d3@syzkaller.appspotmail.com>,
        Yuchung Cheng <ycheng@google.com>
Subject: Re: [PATCH] tcp: Do not reset the icsk_ca_initialized in
 tcp_init_transfer.
Message-ID: <20210628234126.ijdbstfmlsycbqbp@kafai-mbp.dhcp.thefacebook.com>
References: <20210628144908.881499-1-phind.uet@gmail.com>
 <CANn89iJ6M2WFS3B+sSOysekScUFmO9q5YHxgHGsbozbvkW9ivg@mail.gmail.com>
 <79490158-e6d1-aabf-64aa-154b71205c74@gmail.com>
 <CADVnQy=Q9W=Vxu81ctPLx08D=ALnHBXGr0c4BLtQGxwQE+yjRg@mail.gmail.com>
 <ee5ef69e-ee3f-1df0-2033-5adc06a46b9c@gmail.com>
 <CADVnQynqMQhO4cBON=xUCkne9-E1hze3naMZZ8tQ-a0k71kh8g@mail.gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CADVnQynqMQhO4cBON=xUCkne9-E1hze3naMZZ8tQ-a0k71kh8g@mail.gmail.com>
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from kafai-mbp.dhcp.thefacebook.com (2620:10d:c090:400::5:170c) by SJ0PR03CA0361.namprd03.prod.outlook.com (2603:10b6:a03:3a1::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4264.18 via Frontend Transport; Mon, 28 Jun 2021 23:41:27 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 4a8215db-7c06-4627-1ab1-08d93a8e4046
X-MS-TrafficTypeDiagnostic: SA0PR15MB4013:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <SA0PR15MB40134DE9B6D3A15301EDA47FD5039@SA0PR15MB4013.namprd15.prod.outlook.com>
X-FB-Source: Internal
X-MS-Oob-TLC-OOBClassifiers: OLM:7691;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: C4Mj9RkI/ImIhx6G4Nb2t6P1gZGdi4Md3Bnt+sVn8TM9QfReKS/DTmu5TimXoiP86nlUHqeJESpE7yWWxHuGXoj9gkNGWGzBSNcXKHYcLn4PLbqqJ6ZlJO6AGd/FDcWrwXmPk3ubXZPHMQCD+jL/VC9KYg7FCIl+AL6SSac5WqvZqpv6TZ6Z9NSguYQmSvmJde/awek74ntFhj/8YEbAL5ONnWHV09JgStCxnfN7QxyVK9TMhTYNFz0s9t5hkJkBbkAZiUDWuPCJuD4WCO3V0Z3NeSYSDTC4p73TlpxshN6TOPG7Kz+Cr7TcF9K/dUnXBoIYHf05YW/Lea1Y5mj2ROQ7+iIuhbJrefVZx4JOUxYnVfEloNIQJ8eFJsvB+dNJsMe89sLJJ/6vhnkFZkgdZlY0WuTOY+j717G3SGvQ3+0MWmjLyLIXG25M7Hsd7hKC00f4HjBsF/0o7Ux3Zwl+RYcIkvCACniPxdRfsuXeCxFh+uElo4SZ9vqR9Hz5u3+VHtJn49ZPKUVu9aSPQ+9pZCXArolZxW2y/1E5P7B0p0ofRT9NnzpKb8Sstb88AFH//OhRxcVEITvOVNDisxAFoVSBzbHfY6RNmjvWZtpE+1pXXoUg0PTZYFGr/WtModwpuIuMDKb/J+R61BRph+yVPYTsbaaXd/mloFWTBq6ekV2A1ARYv6JbuG1B/9J8NYFGHPA/Aaa0OfsyeTTAsY9aBeD/BxEWxaKuYnAv1/y/Vhr56xqD++RQORE44GwL0YH2
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR15MB5016.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(136003)(376002)(346002)(39860400002)(396003)(8676002)(66476007)(66556008)(66946007)(966005)(3716004)(5660300002)(1076003)(8936002)(38100700002)(6506007)(55016002)(4326008)(478600001)(52116002)(316002)(6916009)(7416002)(86362001)(54906003)(2906002)(7696005)(16526019)(186003)(53546011)(9686003);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?yN8Sj+nceTgtuGZ0q698ecYj54IMUYEjNo1cprENttpmPSGYAtcRYEOWt8tJ?=
 =?us-ascii?Q?I9jSTGYP5LN7ORw1OmaZsSqp7TBzqOg+H3R3X5nf5wa8RuYTkGMNWQa99+oM?=
 =?us-ascii?Q?YiO8u8M8uRXzqh3+XZ/2NwKXDiqC8Tz8vFNgA4W6ptC9IWpQQwzGllI9VAxD?=
 =?us-ascii?Q?G18beyXr3S5ntxilsI8xIRSnqdJWthCnIrpNj6G673yye0jCTssd0dzeOF01?=
 =?us-ascii?Q?psKez+DhD3kztRjxbeJC7JWa9Tx2ahngDwM3YgeMWgeRBxFm/C+voZA2V9jb?=
 =?us-ascii?Q?nvZifeheLrVOZ+7e1YIDJNOs8CfmMSt+SrGrOElc1MxDDry30My8m5HUHnMh?=
 =?us-ascii?Q?jdrOH30Y3U8CKuwDH96VhoFQY/PXLgTtJPGD9F/Fo5YX2sTo9P/zQhGfaCM7?=
 =?us-ascii?Q?83uN7pfOoNTesrI3nCJcMRqJl/S7T7Dkb6ZRFvpFN1Pkqrck5sNA/+liqQxH?=
 =?us-ascii?Q?C5sjYP7aCUqjmvc60f4g1sUkupFs0MwZoD9G9E7ltLpeoCDOSJlfhICFBINR?=
 =?us-ascii?Q?UMvxY/lnTn563ZN+K0Kz/la3ZmkRtkQEdi9+igauph1Y4c1TAuxmkJzFvnL9?=
 =?us-ascii?Q?+wRgFDB68OVbp++bPJ/wQG1Nht7v/Vx1saKSnruFAgI5NLWpPY4w8mCTSYn7?=
 =?us-ascii?Q?FYeg4Pb0o2LyBIwvENIfX/qWJHFk0CNrFoMM6pS5XDMdrgqX3y/hKJgqKvqA?=
 =?us-ascii?Q?Uul1YFJw4K02rKYYfsfEsdSoD3Ai0aadO+u42aN9S57msFSl3nE1oJlmj7tu?=
 =?us-ascii?Q?KRYySpys7Tf2v41zlO5eGldDqpAEx6Cm41eijqMf2z27BdLvJefef0LDD7V9?=
 =?us-ascii?Q?9O8ZbBWr93Z11bLTYd0dfoZHHKIpGpPYnqiucOUvCFhlvf6n+Do9TNcry6Aw?=
 =?us-ascii?Q?gHGoCAdn7F+uVKQBgbcFOHGXkKHoCRk3hybLXsvrycuUQCdoUmhhgq7ICnn/?=
 =?us-ascii?Q?X4C5uFECv4TEhYoHks2ifUCZHm4GWgrv2jB0Em2pMNvrh0d+VaL1ZvlzbdKN?=
 =?us-ascii?Q?r08Rse3l2o09Qi3c7O2n0mK28Cam225v4+HcxqN/ZBLtik+ODFrzz8b5fdNI?=
 =?us-ascii?Q?tzZyKliRvQzbuS46OPfEAiH2THceeQmZYGKqswjCloZ+AxWOxJi20fUCHtBN?=
 =?us-ascii?Q?IkzFOE9zXqvJaXGF/Dyns3AugBQlhwgZ4jHEB7ffU/I0lpOnk7tZCNUSXxAW?=
 =?us-ascii?Q?5Bp48MlpofmkHrdckO1aESsYuKmY+Xh9ldWKx/l3TU3XUkKy9thHMq2g914Y?=
 =?us-ascii?Q?zxklmuyr9Eaa9yFZKgWeJkiwDrmLNJYUBYXfSFQOF8BNOJV0Pz2XUbM7UbV6?=
 =?us-ascii?Q?WsO5Oi1aUiMmycOvRaSJHJZl6SU0Hk9dRqX/3hKO7PbYDw=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 4a8215db-7c06-4627-1ab1-08d93a8e4046
X-MS-Exchange-CrossTenant-AuthSource: SA1PR15MB5016.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Jun 2021 23:41:28.9760
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: WlPPFf6kx2TLbbC6UZ3SmvW+02r4F4om4U5PEXoZRPcq5BrwmXkH4HY00h003IyB
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR15MB4013
X-OriginatorOrg: fb.com
X-Proofpoint-ORIG-GUID: WygZp_tpxBGjIcSB5Auj0fuhRkBJADPH
X-Proofpoint-GUID: WygZp_tpxBGjIcSB5Auj0fuhRkBJADPH
X-Proofpoint-UnRewURL: 1 URL was un-rewritten
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391,18.0.790
 definitions=2021-06-28_14:2021-06-25,2021-06-28 signatures=0
X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 mlxscore=0 suspectscore=0
 impostorscore=0 spamscore=0 malwarescore=0 phishscore=0 adultscore=0
 mlxlogscore=999 priorityscore=1501 bulkscore=0 clxscore=1011
 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2104190000 definitions=main-2106280153
X-FB-Internal: deliver
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Jun 28, 2021 at 01:20:19PM -0400, Neal Cardwell wrote:
> )
> 
> On Mon, Jun 28, 2021 at 1:15 PM Phi Nguyen <phind.uet@gmail.com> wrote:
> >
> > On 6/29/2021 12:24 AM, Neal Cardwell wrote:
> >
> > > Thanks.
> > >
> > > Can you also please provide a summary of the event sequence that
> > > triggers the bug? Based on your Reported-by tag, I guess this is based
> > > on the syzbot reproducer:
> > >
> > >   https://groups.google.com/g/syzkaller-bugs/c/VbHoSsBz0hk/m/cOxOoTgPCAAJ 
> > >
> > > but perhaps you can give a summary of the event sequence that causes
> > > the bug? Is it that the call:
> > >
> > > setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd,
> > > &(0x7f0000000000)='cdg\x00', 0x4)
> > >
> > > initializes the CC and happens before the connection is established,
> > > and then when the connection is established, the line that sets:
> > >    icsk->icsk_ca_initialized = 0;
> > > is incorrect, causing the CC to be initialized again without first
> > > calling the cleanup code that deallocates the CDG-allocated memory?
> > >
> > > thanks,
> > > neal
> > >
> >
> > Hi Neal,
> >
> > The gdb stack trace that lead to init_transfer_input() is as bellow, the
> > current sock state is TCP_SYN_RECV.
> 
> Thanks. That makes sense as a snapshot of time for
> tcp_init_transfer(), but I think what would be more useful would be a
> description of the sequence of events, including when the CC was
> initialized previous to that point (as noted above, was it that the
> setsockopt(TCP_CONGESTION) completed before that point?).
+1.  It needs to first explain when was the very first CC initialized.