To handle shutdown(SHUT_RD) we flush the receive buffer of the socket.
This may involve searching for control messages of type SCM_RIGHTS,
since we need to close the file references. Closing arbitrary files
with socket buffer locks held is undesirable, mainly due to lock
ordering issues, so we instead make a copy of the socket buffer and
operate on that without any locks. Fields in the original buffer are
cleared.
This behaviour clobbered the AIO job queue associated with a receive
buffer. It could also cause us to leak a KTLS session reference.
Reorder socket buffer fields to address this. Add a regression test for
AIO.
I tried removing this hack in sorflush() but it's not quite feasible
(yet). In particular, though sorflush() flags the sockbuf with
SBS_CANTRCVMORE, it is possible for more data to be added - the flag
just prevents userspace from reading more data. I suspect we should fix
this; SBS_CANTRCVMORE represents a terminal state and protocols can
likely just drop any data destined for such a buffer. Many of them
already do, but in some cases the check is racy, and some KPI churn will
be needed to fix everything. This approach is easier for now.
Reported by: syzbot+104d8ee3430361cb2795@syzkaller.appspotmail.com
Reported by: syzbot+5bd2e7d05f84a59d0d1b@syzkaller.appspotmail.com