Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <000000000000a61ffe05fe0c3d08@google.com>
References: <000000000000a61ffe05fe0c3d08@google.com>
To:     syzbot <syzbot+dd1339599f1840e4cc65@syzkaller.appspotmail.com>
Cc:     dhowells@redhat.com, bpf@vger.kernel.org, davem@davemloft.net,
        edumazet@google.com, kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, pabeni@redhat.com,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] WARNING in unreserve_psock
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1665042.1686763322.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Wed, 14 Jun 2023 18:22:02 +0100
Message-ID: <1665043.1686763322@warthog.procyon.org.uk>
Precedence: bulk

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.g=
it main

    kcm: Fix unnecessary psock unreservation.
    =

    kcm_write_msgs() calls unreserve_psock() to release its hold on the
    underlying TCP socket if it has run out of things to transmit, but if =
we
    have nothing in the write queue on entry (e.g. because someone did a
    zero-length sendmsg), we don't actually go into the transmission loop =
and
    as a consequence don't call reserve_psock().
    =

    Fix this by skipping the call to unreserve_psock() if we didn't reserv=
e a
    psock.
    =

    Fixes: c31a25e1db48 ("kcm: Send multiple frags in one sendmsg()")
    Reported-by: syzbot+dd1339599f1840e4cc65@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/r/000000000000a61ffe05fe0c3d08@google.co=
m/
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Tom Herbert <tom@herbertland.com>
    cc: Tom Herbert <tom@quantonium.net>
    cc: "David S. Miller" <davem@davemloft.net>
    cc: Eric Dumazet <edumazet@google.com>
    cc: Jakub Kicinski <kuba@kernel.org>
    cc: Paolo Abeni <pabeni@redhat.com>
    cc: Jens Axboe <axboe@kernel.dk>
    cc: Matthew Wilcox <willy@infradead.org>
    cc: netdev@vger.kernel.org

diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index d75d775e9462..d0537c1c8cd7 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -661,6 +661,7 @@ static int kcm_write_msgs(struct kcm_sock *kcm)
 				kcm_abort_tx_psock(psock, ret ? -ret : EPIPE,
 						   true);
 				unreserve_psock(kcm);
+				psock =3D NULL;
 =

 				txm->started_tx =3D false;
 				kcm_report_tx_retry(kcm);
@@ -696,7 +697,8 @@ static int kcm_write_msgs(struct kcm_sock *kcm)
 	if (!head) {
 		/* Done with all queued messages. */
 		WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
-		unreserve_psock(kcm);
+		if (psock)
+			unreserve_psock(kcm);
 	}
 =

 	/* Check if write space is available */