[5.4,033/123] cgroup: memcg: net: do not associate sock with unrelated cgroup

From: Shakeel Butt <shakeelb@google.com>

From: Shakeel Butt <shakeelb@google.com>

[ Upstream commit e876ecc67db80dfdb8e237f71e5b43bb88ae549c ]

We are testing network memory accounting in our setup and noticed
inconsistent network memory usage and often unrelated cgroups network
usage correlates with testing workload. On further inspection, it
seems like mem_cgroup_sk_alloc() and cgroup_sk_alloc() are broken in
irq context specially for cgroup v1.

mem_cgroup_sk_alloc() and cgroup_sk_alloc() can be called in irq context
and kind of assumes that this can only happen from sk_clone_lock()
and the source sock object has already associated cgroup. However in
cgroup v1, where network memory accounting is opt-in, the source sock
can be unassociated with any cgroup and the new cloned sock can get
associated with unrelated interrupted cgroup.

Cgroup v2 can also suffer if the source sock object was created by
process in the root cgroup or if sk_alloc() is called in irq context.
The fix is to just do nothing in interrupt.

WARNING: Please note that about half of the TCP sockets are allocated
from the IRQ context, so, memory used by such sockets will not be
accouted by the memcg.

The stack trace of mem_cgroup_sk_alloc() from IRQ-context:

CPU: 70 PID: 12720 Comm: ssh Tainted:  5.6.0-smp-DEV #1
Hardware name: ...
Call Trace:
 <IRQ>
 dump_stack+0x57/0x75
 mem_cgroup_sk_alloc+0xe9/0xf0
 sk_clone_lock+0x2a7/0x420
 inet_csk_clone_lock+0x1b/0x110
 tcp_create_openreq_child+0x23/0x3b0
 tcp_v6_syn_recv_sock+0x88/0x730
 tcp_check_req+0x429/0x560
 tcp_v6_rcv+0x72d/0xa40
 ip6_protocol_deliver_rcu+0xc9/0x400
 ip6_input+0x44/0xd0
 ? ip6_protocol_deliver_rcu+0x400/0x400
 ip6_rcv_finish+0x71/0x80
 ipv6_rcv+0x5b/0xe0
 ? ip6_sublist_rcv+0x2e0/0x2e0
 process_backlog+0x108/0x1e0
 net_rx_action+0x26b/0x460
 __do_softirq+0x104/0x2a6
 do_softirq_own_stack+0x2a/0x40
 </IRQ>
 do_softirq.part.19+0x40/0x50
 __local_bh_enable_ip+0x51/0x60
 ip6_finish_output2+0x23d/0x520
 ? ip6table_mangle_hook+0x55/0x160
 __ip6_finish_output+0xa1/0x100
 ip6_finish_output+0x30/0xd0
 ip6_output+0x73/0x120
 ? __ip6_finish_output+0x100/0x100
 ip6_xmit+0x2e3/0x600
 ? ipv6_anycast_cleanup+0x50/0x50
 ? inet6_csk_route_socket+0x136/0x1e0
 ? skb_free_head+0x1e/0x30
 inet6_csk_xmit+0x95/0xf0
 __tcp_transmit_skb+0x5b4/0xb20
 __tcp_send_ack.part.60+0xa3/0x110
 tcp_send_ack+0x1d/0x20
 tcp_rcv_state_process+0xe64/0xe80
 ? tcp_v6_connect+0x5d1/0x5f0
 tcp_v6_do_rcv+0x1b1/0x3f0
 ? tcp_v6_do_rcv+0x1b1/0x3f0
 __release_sock+0x7f/0xd0
 release_sock+0x30/0xa0
 __inet_stream_connect+0x1c3/0x3b0
 ? prepare_to_wait+0xb0/0xb0
 inet_stream_connect+0x3b/0x60
 __sys_connect+0x101/0x120
 ? __sys_getsockopt+0x11b/0x140
 __x64_sys_connect+0x1a/0x20
 do_syscall_64+0x51/0x200
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The stack trace of mem_cgroup_sk_alloc() from IRQ-context:
Fixes: 2d7580738345 ("mm: memcontrol: consolidate cgroup socket tracking")
Fixes: d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets")
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Roman Gushchin <guro@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cgroup/cgroup.c |    4 ++++
 mm/memcontrol.c        |    4 ++++
 2 files changed, 8 insertions(+)

Message ID	20200317103311.269332438@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=f8y2=5C=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Shakeel Butt <shakeelb@google.com>, Roman Gushchin <guro@fb.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.4 033/123] cgroup: memcg: net: do not associate sock with unrelated cgroup Date: Tue, 17 Mar 2020 11:54:20 +0100 Message-Id: <20200317103311.269332438@linuxfoundation.org> In-Reply-To: <20200317103307.343627747@linuxfoundation.org> References: <20200317103307.343627747@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.4,002/123] ALSA: hda/realtek - More constifications [5.4,003/123] ALSA: hda/realtek - Add Headset Mic supported for HP cPC [5.4,004/123] ALSA: hda/realtek - Fixed one of HP ALC671 platform Headset Mic supported [5.4,005/123] cgroup, netclassid: periodically release file_lock on classid updating [5.4,007/123] inet_diag: return classid for all socket types [5.4,009/123] ipvlan: add cond_resched_rcu() while processing muticast backlog [5.4,011/123] ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() [5.4,012/123] ipvlan: dont deref eth hdr before checking its set [5.4,015/123] net: dsa: mv88e6xxx: fix lockup on warm boot [5.4,016/123] net: fec: validate the new settings in fec_enet_set_coalesce() [5.4,018/123] net/ipv6: use configured metric when add peer route [5.4,022/123] net/packet: tpacket_rcv: do not increment ring index on drop [5.4,023/123] net: phy: bcm63xx: fix OOPS due to missing driver name [5.4,025/123] net: systemport: fix index check to avoid an array out of bounds access [5.4,028/123] slip: make slhc_compress() more robust against malicious packets [5.4,031/123] bnxt_en: reinitialize IRQs when MTU is modified [5.4,032/123] bnxt_en: fix error handling when flashing from file [5.4,033/123] cgroup: memcg: net: do not associate sock with unrelated cgroup [5.4,034/123] net: memcg: late association of sock to memcg [5.4,035/123] net: memcg: fix lockdep splat in inet_csk_accept() [5.4,036/123] devlink: validate length of param values [5.4,039/123] nl802154: add missing attribute validation [5.4,042/123] macsec: add missing attribute validation for port [5.4,044/123] net: taprio: add missing attribute validation for txtime delay [5.4,045/123] team: add missing attribute validation for port ifindex [5.4,048/123] nfc: add missing attribute validation for SE API [5.4,052/123] net: phy: fix MDIO bus PM PHY resuming [5.4,053/123] net/ipv6: need update peer route when modify metric [5.4,056/123] net: dsa: Dont instantiate phylink for CPU/DSA ports unless needed [5.4,058/123] cgroup: cgroup_procs_next should increase position index [5.4,059/123] cgroup: Iterate tasks that did not finish do_exit() [5.4,062/123] virtio-blk: fix hw_queue stopped on arbitrary error [5.4,063/123] iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint [5.4,068/123] workqueue: dont use wq_select_unbound_cpu() for bound works [5.4,069/123] drm/amd/display: remove duplicated assignment to grph_obj_type [5.4,074/123] ktest: Add timeout for ssh sync testing [5.4,076/123] gfs2_atomic_open(): fix O_EXCL\|O_CREAT handling on cold dcache [5.4,079/123] ARC: define __ALIGN_STR and __ALIGN symbols for ARC [5.4,081/123] s390/dasd: fix data corruption for thin provisioned devices [5.4,083/123] blk-iocost: fix incorrect vtime comparison in iocg_is_idle() [5.4,085/123] macintosh: windfarm: fix MODINFO regression [5.4,087/123] efi: Fix a race and a buffer overflow while reading efivars via sysfs [5.4,088/123] efi: Add a sanity check to efivar_store_raw() [5.4,090/123] mt76: fix array overflow on receiving too many fragments for a packet [5.4,091/123] perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag [5.4,092/123] x86/mce: Fix logic and comments around MSR_PPIN_CTL [5.4,095/123] iommu/vt-d: Fix RCU list debugging warnings [5.4,098/123] clk: imx8mn: Fix incorrect clock defines [5.4,099/123] pinctrl: meson-gxl: fix GPIOX sdio pins [5.4,101/123] virtio_ring: Fix mem leak with vring_new_virtqueue() [5.4,104/123] drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits [5.4,107/123] i2c: gpio: suppress error on probe defer [5.4,108/123] nl80211: add missing attribute validation for critical protocol indication [5.4,109/123] nl80211: add missing attribute validation for beacon report scanning [5.4,110/123] nl80211: add missing attribute validation for channel switch [5.4,111/123] perf bench futex-wake: Restore thread count default to online CPU count [5.4,113/123] netfilter: nft_payload: add missing attribute validation for payload csum flags [5.4,116/123] netfilter: nft_chain_nat: inet family is missing module ownership [5.4,117/123] iommu/vt-d: Fix the wrong printing in RHSA parsing [5.4,119/123] i2c: acpi: put device when verifying client fails [5.4,121/123] ipv6: restrict IPV6_ADDRFORM operation [5.4,123/123] net/smc: cancel event worker during device removal

[5.4,033/123] cgroup: memcg: net: do not associate sock with unrelated cgroup

Commit Message

Patch