| Message ID | 20121031124318.30915.32293.stgit@dragon |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Wed, 2012-10-31 at 13:45 +0100, Jesper Dangaard Brouer wrote: > Reading TCP stats when using TCP Illinois congestion control algorithm > can cause a divide by zero kernel oops. > > The division by zero occur in tcp_illinois_info() at: > do_div(t, ca->cnt_rtt); > where ca->cnt_rtt can become zero (when rtt_reset is called) > > Cc: Petr Matousek <pmatouse@redhat.com> > Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> > > --- Acked-by: Eric Dumazet <edumazet@google.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, 31 Oct 2012 13:45:32 +0100 Jesper Dangaard Brouer <brouer@redhat.com> wrote: > Reading TCP stats when using TCP Illinois congestion control algorithm > can cause a divide by zero kernel oops. > > The division by zero occur in tcp_illinois_info() at: > do_div(t, ca->cnt_rtt); > where ca->cnt_rtt can become zero (when rtt_reset is called) > > Steps to Reproduce: > 1. Register tcp_illinois: > # sysctl -w net.ipv4.tcp_congestion_control=illinois > 2. Monitor internal TCP information via command "ss -i" > # watch -d ss -i > 3. Establish new TCP conn to machine > > Either it fails at the initial conn, or else it needs to wait > for a loss or a reset. > > This is only related to reading stats. The function avg_delay() also > performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its > calling point in update_params(). Thus, simply fix tcp_illinois_info(). > > Function tcp_illinois_info() / get_info() is called without > socket lock. Thus, eliminate any race condition on ca->cnt_rtt > by using a local stack variable. Simply reuse info.tcpv_rttcnt, > as its already set to ca->cnt_rtt. > Function avg_delay() is not affected by this race condition, as > its called with the socket lock. > > Cc: Petr Matousek <pmatouse@redhat.com> > Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> > > --- > V2: > Address Eric Dumazets input: > - Save 2 bytes of stack, by using info.tcpv_rttcnt. > - Help compiler, and define "u64 t" inside if() lexical scope. > > > net/ipv4/tcp_illinois.c | 8 +++++--- > 1 files changed, 5 insertions(+), 3 deletions(-) > > diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c > index 813b43a..834857f 100644 > --- a/net/ipv4/tcp_illinois.c > +++ b/net/ipv4/tcp_illinois.c > @@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext, > .tcpv_rttcnt = ca->cnt_rtt, > .tcpv_minrtt = ca->base_rtt, > }; > - u64 t = ca->sum_rtt; > > - do_div(t, ca->cnt_rtt); > - info.tcpv_rtt = t; > + if (info.tcpv_rttcnt > 0) { > + u64 t = ca->sum_rtt; > > + do_div(t, info.tcpv_rttcnt); > + info.tcpv_rtt = t; > + } > nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); > } > } > Acked-by: Stephen Hemminger <shemminger@vyatta.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, 2012-10-31 at 13:48 -0700, Stephen Hemminger wrote: > On Wed, 31 Oct 2012 13:45:32 +0100 > Jesper Dangaard Brouer <brouer@redhat.com> wrote: > > > Reading TCP stats when using TCP Illinois congestion control algorithm > > can cause a divide by zero kernel oops. [...] > > Acked-by: Stephen Hemminger <shemminger@vyatta.com> When DaveM is without power, people even have/get time to review and ack my patches ;-). Thanks Stephen and Eric. --Jesper -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Wed, 31 Oct 2012 18:14:38 +0100 > On Wed, 2012-10-31 at 13:45 +0100, Jesper Dangaard Brouer wrote: >> Reading TCP stats when using TCP Illinois congestion control algorithm >> can cause a divide by zero kernel oops. >> >> The division by zero occur in tcp_illinois_info() at: >> do_div(t, ca->cnt_rtt); >> where ca->cnt_rtt can become zero (when rtt_reset is called) >> > >> Cc: Petr Matousek <pmatouse@redhat.com> >> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> >> >> --- > > Acked-by: Eric Dumazet <edumazet@google.com> Applied, thanks everyone. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c index 813b43a..834857f 100644 --- a/net/ipv4/tcp_illinois.c +++ b/net/ipv4/tcp_illinois.c @@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext, .tcpv_rttcnt = ca->cnt_rtt, .tcpv_minrtt = ca->base_rtt, }; - u64 t = ca->sum_rtt; - do_div(t, ca->cnt_rtt); - info.tcpv_rtt = t; + if (info.tcpv_rttcnt > 0) { + u64 t = ca->sum_rtt; + do_div(t, info.tcpv_rttcnt); + info.tcpv_rtt = t; + } nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); } }
Reading TCP stats when using TCP Illinois congestion control algorithm can cause a divide by zero kernel oops. The division by zero occur in tcp_illinois_info() at: do_div(t, ca->cnt_rtt); where ca->cnt_rtt can become zero (when rtt_reset is called) Steps to Reproduce: 1. Register tcp_illinois: # sysctl -w net.ipv4.tcp_congestion_control=illinois 2. Monitor internal TCP information via command "ss -i" # watch -d ss -i 3. Establish new TCP conn to machine Either it fails at the initial conn, or else it needs to wait for a loss or a reset. This is only related to reading stats. The function avg_delay() also performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its calling point in update_params(). Thus, simply fix tcp_illinois_info(). Function tcp_illinois_info() / get_info() is called without socket lock. Thus, eliminate any race condition on ca->cnt_rtt by using a local stack variable. Simply reuse info.tcpv_rttcnt, as its already set to ca->cnt_rtt. Function avg_delay() is not affected by this race condition, as its called with the socket lock. Cc: Petr Matousek <pmatouse@redhat.com> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> --- V2: Address Eric Dumazets input: - Save 2 bytes of stack, by using info.tcpv_rttcnt. - Help compiler, and define "u64 t" inside if() lexical scope. net/ipv4/tcp_illinois.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html