From: Evgeniy Polyakov <johnpol@2ka•mipt.ru>
To: Octavian Purdila <opurdila@ixiacom•com>
Cc: Ben Hutchings <bhutchings@solarflare•com>,
netdev@vger•kernel.org, davem@davemloft•net
Subject: Re: race in skb_splice_bits?
Date: Tue, 27 May 2008 18:03:18 +0400 [thread overview]
Message-ID: <20080527140318.GA6963@2ka.mipt.ru> (raw)
In-Reply-To: <20080527132148.GA7368@2ka.mipt.ru>
On Tue, May 27, 2008 at 05:21:48PM +0400, Evgeniy Polyakov (johnpol@2ka•mipt.ru) wrote:
> On Tue, May 27, 2008 at 03:53:49PM +0300, Octavian Purdila (opurdila@ixiacom•com) wrote:
> > When you interrupt the program, the system will crash.
>
> Cool!
>
> I've reproduced the problem and will try to work it out, thank you.
Attached patch fixes the crash for me, Octavian could you please test
it.
David, is __kfree_skb() usage in tcp_read_sock() an optimisation only?
With this patch I do not see any leaks, but I did not investigate it
deep enough. If approach seems correct, I will clean things up.
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6087013..d285817 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1349,6 +1349,7 @@ done:
if (spd.nr_pages) {
int ret;
+ struct sock *sk = __skb->sk;
/*
* Drop the socket lock, otherwise we have reverse
@@ -1359,9 +1360,9 @@ done:
* we call into ->sendpage() with the i_mutex lock held
* and networking will grab the socket lock.
*/
- release_sock(__skb->sk);
+ release_sock(sk);
ret = splice_to_pipe(pipe, &spd);
- lock_sock(__skb->sk);
+ lock_sock(sk);
return ret;
}
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 39b629a..b8318e9 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1182,6 +1182,23 @@ static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
return NULL;
}
+#ifdef CONFIG_NET_DMA
+static inline void __sk_eat_skb(struct sock *sk, struct sk_buff *skb, int copied_early)
+{
+ __skb_unlink(skb, &sk->sk_receive_queue);
+ if (!copied_early)
+ kfree_skb(skb);
+ else
+ __skb_queue_tail(&sk->sk_async_wait_queue, skb);
+}
+#else
+static inline void __sk_eat_skb(struct sock *sk, struct sk_buff *skb, int copied_early)
+{
+ __skb_unlink(skb, &sk->sk_receive_queue);
+ kfree_skb(skb);
+}
+#endif
+
/*
* This routine provides an alternative to tcp_recvmsg() for routines
* that would like to handle copying from skbuffs directly in 'sendfile'
@@ -1231,11 +1248,11 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
break;
}
if (tcp_hdr(skb)->fin) {
- sk_eat_skb(sk, skb, 0);
+ __sk_eat_skb(sk, skb, 0);
++seq;
break;
}
- sk_eat_skb(sk, skb, 0);
+ __sk_eat_skb(sk, skb, 0);
if (!desc->count)
break;
}
--
Evgeniy Polyakov
next prev parent reply other threads:[~2008-05-27 14:03 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-05-27 0:25 race in skb_splice_bits? Octavian Purdila
2008-05-27 2:08 ` Ben Hutchings
2008-05-27 10:41 ` Octavian Purdila
2008-05-27 11:01 ` Evgeniy Polyakov
2008-05-27 11:08 ` Ben Hutchings
2008-05-27 11:52 ` Evgeniy Polyakov
2008-05-27 11:56 ` Evgeniy Polyakov
2008-05-27 12:53 ` Octavian Purdila
2008-05-27 13:21 ` Evgeniy Polyakov
2008-05-27 14:03 ` Evgeniy Polyakov [this message]
2008-05-27 14:39 ` Octavian Purdila
2008-05-27 15:09 ` Evgeniy Polyakov
2008-05-27 15:12 ` Evgeniy Polyakov
2008-05-27 15:22 ` Evgeniy Polyakov
2008-05-27 15:33 ` Octavian Purdila
2008-05-27 15:47 ` Evgeniy Polyakov
2008-05-27 17:28 ` Evgeniy Polyakov
2008-05-27 23:59 ` Octavian Purdila
2008-05-28 8:52 ` Evgeniy Polyakov
2008-05-28 13:20 ` Octavian Purdila
2008-05-28 14:11 ` Evgeniy Polyakov
2008-05-28 15:20 ` Octavian Purdila
2008-05-28 15:42 ` Evgeniy Polyakov
2008-05-28 17:08 ` Octavian Purdila
2008-05-28 17:51 ` Evgeniy Polyakov
2008-05-28 18:02 ` Octavian Purdila
2008-05-28 20:01 ` Jarek Poplawski
2008-05-28 20:09 ` Octavian Purdila
2008-05-28 20:16 ` Jarek Poplawski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080527140318.GA6963@2ka.mipt.ru \
--to=johnpol@2ka$(echo .)mipt.ru \
--cc=bhutchings@solarflare$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=opurdila@ixiacom$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox