bpf: sk_msg, zap ingress queue on psock down

In addition to releasing any cork'ed data on a psock when the psock
is removed we should also release any skb's in the ingress work queue.
Otherwise the skb's eventually get free'd but late in the tear
down process so we see the WARNING due to non-zero sk_forward_alloc.

  void sk_stream_kill_queues(struct sock *sk)
  {
	...
	WARN_ON(sk->sk_forward_alloc);
	...
  }

Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 3df7627db4bb5728f822c8a8fa9c4753454bf79b..86c9726fced80818e07c276e840540467758414f 100644 (file)
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -572,6 +572,7 @@ void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
 {
        rcu_assign_sk_user_data(sk, NULL);
        sk_psock_cork_free(psock);
+       sk_psock_zap_ingress(psock);
        sk_psock_restore_proto(sk, psock);
 
        write_lock_bh(&sk->sk_callback_lock);