On Tue, 2017-09-26 at 17:38 -0700, Christoph Paasch wrote: > sk->sk_prot and sk->sk_prot_creator can differ when the app uses > IPV6_ADDRFORM (transforming an IPv6-socket to an IPv4-one). > Which is why sk_prot_creator is there to make sure that sk_prot_free() > does the kmem_cache_free() on the right kmem_cache slab. > > Now, if such a socket gets transformed back to a listening socket (using > connect() with AF_UNSPEC) we will allocate an IPv4 tcp_sock through > sk_clone_lock() when a new connection comes in. But sk_prot_creator will > still point to the IPv6 kmem_cache (as everything got copied in > sk_clone_lock()). When freeing, we will thus put this > memory back into the IPv6 kmem_cache although it was allocated in the > IPv4 cache. I have seen memory corruption happening because of this. > > With slub-debugging and MEMCG_KMEM enabled this gives the warning > "cache_from_obj: Wrong slab cache. TCPv6 but object is from TCP"
Nice catch, thanks ! Reviewed-by: Eric Dumazet <eduma...@google.com>
