On Wed, Mar 1, 2017 at 1:43 PM, Cong Wang <xiyou.wangc...@gmail.com> wrote: >> >> This one looks very similar to a previous one: >> https://groups.google.com/forum/#!topic/syzkaller/BhyN5OFd7sQ >> >> Both happen on raw v6 sockets. >> >> For me, it seems the sk refcnt is not correct, skb should still hold >> a refcnt so it should not be freed before kfree_skb() in a timer >> handler... > > More precisely, after this commit: > > commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 > Author: Eric Dumazet <eric.duma...@gmail.com> > Date: Thu Jun 11 02:55:43 2009 -0700 > > net: No more expensive sock_hold()/sock_put() on each tx > > we don't take (old) refcnt any more on TX path, sk_wmem_alloc > is the new refcnt. ;)
So the bug is that skb->truesize is mangled by reassembly unit, while sbk->sk is tracking sk_wmem_alloc changes in order to decide when it is safe to free sk. This is why we need to call skb_orphan(), as we did for IPv4 in 8282f27449bf15548