From patchwork Wed Nov 7 23:42:34 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 197739 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6E3B52C00F8 for ; Thu, 8 Nov 2012 10:42:51 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754537Ab2KGXmi (ORCPT ); Wed, 7 Nov 2012 18:42:38 -0500 Received: from mail-da0-f46.google.com ([209.85.210.46]:63006 "EHLO mail-da0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754428Ab2KGXmh (ORCPT ); Wed, 7 Nov 2012 18:42:37 -0500 Received: by mail-da0-f46.google.com with SMTP id n41so906257dak.19 for ; Wed, 07 Nov 2012 15:42:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:from:to:cc:in-reply-to:references:content-type:date :message-id:mime-version:x-mailer:content-transfer-encoding; bh=vRreTkr3r8NjUcsz1am9+UnN5h/tdxJciiRkM6I/DU0=; b=BSvpE3rL/dHqJJ5GuaHxELIBNLbppuMgK0c/BA3G0KtnR4sF0ZReK0wpbHtk3xim5H JKRSw9zi54gP2r3u8c283Jcm1vXjquPon4F5OoN+PDIhboPFk/chcF9Xg0jFZMUbR/be 0J+0ZKxc3LE/fKwrxlr4YybhG4TWRJ8RrHBQ2c+WcfjIT2DYHIv/GFOLrxmvmKJ1jEEX 4DDinFacVAaroJOKq6CvxKOTb9nqQfXyKLEFqAtPxQQ9UDpdlxXUcEfIbT7S3k/hMdPT YEtd+fKoRb7NDfkwk9Vywyf0OghtBVkatrOlhZDyblINW7mqWOzwB6Lvs3t4MTUJJ/g6 gcUw== Received: by 10.68.238.72 with SMTP id vi8mr11655409pbc.55.1352331756683; Wed, 07 Nov 2012 15:42:36 -0800 (PST) Received: from [172.19.68.135] (dhcp-172-19-68-135.mtv.corp.google.com [172.19.68.135]) by mx.google.com with ESMTPS id j8sm15006490paz.30.2012.11.07.15.42.35 (version=SSLv3 cipher=OTHER); Wed, 07 Nov 2012 15:42:35 -0800 (PST) Subject: Re: [PATCH] tcp: Avoid infinite loop on recvmsg bug From: Eric Dumazet To: Julius Werner Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org, Patrick McHardy , Hideaki YOSHIFUJI , James Morris , Alexey Kuznetsov , "David S. Miller" , Dave Jones , Sameer Nanda , Mandeep Singh Baines In-Reply-To: <1352331192.2748.10.camel@edumazet-glaptop> References: <1352316791-16491-1-git-send-email-jwerner@chromium.org> <1352317219.5552.6.camel@edumazet-glaptop> <1352331192.2748.10.camel@edumazet-glaptop> Date: Wed, 07 Nov 2012 15:42:34 -0800 Message-ID: <1352331754.2748.14.camel@edumazet-glaptop> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Wed, 2012-11-07 at 15:33 -0800, Eric Dumazet wrote: > So you probably are fighting a bug we already fixed in upstream kernel. > > (commit c8628155ece363 "tcp: reduce out_of_order memory use" did not > played well with cloned skbs.) > > This issue was already discussed on netdev in the past. If you use a 3.4 kernel, you want the following patch. (I guess you could reproduce the crash easily running a tcpdump in //) --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 257b617..9f8f68c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4496,7 +4496,9 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) * to avoid future tcp_collapse_ofo_queue(), * probably the most expensive function in tcp stack. */ - if (skb->len <= skb_tailroom(skb1) && !tcp_hdr(skb)->fin) { + if (skb->len <= skb_tailroom(skb1) && + !tcp_hdr(skb)->fin && + !skb_cloned(skb1)) { NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOALESCE); BUG_ON(skb_copy_bits(skb, 0,