From patchwork Thu Apr 25 01:34:55 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 239370 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 422E62C00F5 for ; Thu, 25 Apr 2013 11:35:11 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932217Ab3DYBe7 (ORCPT ); Wed, 24 Apr 2013 21:34:59 -0400 Received: from mail-pd0-f179.google.com ([209.85.192.179]:64532 "EHLO mail-pd0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932143Ab3DYBe6 (ORCPT ); Wed, 24 Apr 2013 21:34:58 -0400 Received: by mail-pd0-f179.google.com with SMTP id x11so1471322pdj.38 for ; Wed, 24 Apr 2013 18:34:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:subject:from:to:cc:date:in-reply-to :references:content-type:x-mailer:content-transfer-encoding :mime-version; bh=ISgYWLZXthiw07ikrwELZI//J0S8kP8zl4PeoErBvU8=; b=TguzrB0YuCaUVXrvmBtkGaJLGbj0ZIh5U6Lam79tKkgumMjoWGXlMUyB8Gxf9DIaVB xzbUpaXObcwLUIblBOC2M+wgXM8y6lDTqPDmWt/aTC3/avFHIXGpyeDtMJgqcDJE8a5u 28Nrbyke28t12qQjAQvcHRZXD+9ei3oV5b7/rReivqKOYBVea0TxMWWiSiASP9vVMyzG 8rkrlyMg8Qm9qDDs8fgc3sdCut70gEZK5kBjRCmprcDvMIOUI15hS2O6pUftoroDxjkk wThDWxwJxyz+tnIjaaPISfZthlAoZb4ph7yCt4DeUr4pP9AwT4ZJH/LLL635kMb42GRl 6TIA== X-Received: by 10.66.163.198 with SMTP id yk6mr21959750pab.2.1366853697770; Wed, 24 Apr 2013 18:34:57 -0700 (PDT) Received: from [172.26.50.178] ([172.26.50.178]) by mx.google.com with ESMTPSA id bs3sm5050227pbb.36.2013.04.24.18.34.56 for (version=SSLv3 cipher=RC4-SHA bits=128/128); Wed, 24 Apr 2013 18:34:56 -0700 (PDT) Message-ID: <1366853695.8964.120.camel@edumazet-glaptop> Subject: Re: 3.6-rt: inet_sk_rx_dst_set() network splat From: Eric Dumazet To: Mike Galbraith , David Miller Cc: RT , netdev Date: Wed, 24 Apr 2013 18:34:55 -0700 In-Reply-To: <1366786204.5977.10.camel@marge.simpson.net> References: <1366786204.5977.10.camel@marge.simpson.net> X-Mailer: Evolution 3.2.3-0ubuntu6 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet On Wed, 2013-04-24 at 08:50 +0200, Mike Galbraith wrote: > Giving 3.6-rt some routine usage runtime, while updating kernel git > repositories, the below fell out, but didn't repeat while updating other > repositories. > > [ 381.481464] ------------[ cut here ]------------ > [ 381.486090] WARNING: at include/linux/skbuff.h:536 inet_sk_rx_dst_set+0x8c/0xe0() > [ 381.493566] Hardware name: MS-7502 > [ 381.493612] Modules linked in: ip6table_filter ip6_tables iptable_filter ip_tables ebtable_nat ebtables x_tables nfsd snd_pcm_oss snd_mixer_oss snd_seq nfs_acl snd_seq_device auth_rpcgss edd nfs fscache lockd sunrpc bridge ipv6 stp cpufreq_conservative cpufreq_ondemand cpufreq_userspace cpufreq_powersave acpi_cpufreq mperf nls_iso8859_1 nls_cp437 vfat fat fuse ext3 jbd arc4 rt2800usb rt2800lib crc_ccitt rt2x00usb rt2x00lib mac80211 iTCO_wdt iTCO_vendor_support cfg80211 hid_generic rfkill usb_storage snd_hda_codec_realtek sr_mod cdrom sg snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_timer e1000e snd firewire_ohci firewire_core coretemp microcode soundcore lpc_ich mfd_core crc_itu_t snd_page_alloc i2c_i801 button ext4 mbcache jbd2 crc16 usbhid hid sd_mod crc_t10dif uhci_hcd ehci_hcd rtc_cmos ahci libahci libata thermal fan scsi_mod usbcore usb_common processor > [ 381.493620] Pid: 6170, comm: git Not tainted 3.6.11.1-rt32-smp #52 > [ 381.493621] Call Trace: > [ 381.493626] [] warn_slowpath_common+0x7f/0xc0 > [ 381.493629] [] warn_slowpath_null+0x1a/0x20 > [ 381.493631] [] inet_sk_rx_dst_set+0x8c/0xe0 > [ 381.493633] [] tcp_rcv_established+0x797/0x7d0 > [ 381.493636] [] tcp_v4_do_rcv+0x134/0x220 > [ 381.493638] [] tcp_prequeue_process+0x67/0xb0 > [ 381.493641] [] tcp_recvmsg+0xaca/0xd70 > [ 381.493645] [] ? __lock_release+0x6b/0xe0 > [ 381.493648] [] inet_recvmsg+0x121/0x240 > [ 381.493651] [] ? inet_sock_destruct+0x230/0x230 > [ 381.493655] [] sock_aio_read.part.19+0xf9/0x120 > [ 381.493657] [] ? sock_aio_write+0x90/0xb0 > [ 381.493660] [] sock_aio_read+0x26/0x30 > [ 381.493662] [] do_sync_read+0xa3/0xe0 > [ 381.493665] [] vfs_read+0x14d/0x160 > [ 381.493667] [] sys_read+0x4d/0x90 > [ 381.493670] [] system_call_fastpath+0x16/0x1b > [ 381.493671] ---[ end trace 0000000000000002 ]--- > > 529 static inline struct dst_entry *skb_dst(const struct sk_buff *skb) > 530 { > 531 /* If refdst was not refcounted, check we still are in a > 532 * rcu_read_lock section > 533 */ > 534 WARN_ON((skb->_skb_refdst & SKB_DST_NOREF) && > 535 !rcu_read_lock_held() && > 536 !rcu_read_lock_bh_held()); > 537 return (struct dst_entry *)(skb->_skb_refdst & SKB_DST_PTRMASK); > 538 } > Thanks for the report, here is a fix. It will be a bit of a hassle to merge this one on net-next, as tcp_prequeue() was moved in commit b2fb4f54ecd47c42413d54b4666b06cf93c05abf (tcp: uninline tcp_prequeue() ) David, maybe you prefer to pull into net tree the move, then I respin the fix ? [PATCH] tcp: force a dst refcount when prequeue packet Before escaping RCU protected section and adding packet into prequeue, make sure the dst is refcounted. Reported-by: Mike Galbraith Signed-off-by: Eric Dumazet --- include/net/tcp.h | 1 + 1 file changed, 1 insertion(+) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/net/tcp.h b/include/net/tcp.h index cf0694d..a345480 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1049,6 +1049,7 @@ static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb) skb_queue_len(&tp->ucopy.prequeue) == 0) return false; + skb_dst_force(skb); __skb_queue_tail(&tp->ucopy.prequeue, skb); tp->ucopy.memory += skb->truesize; if (tp->ucopy.memory > sk->sk_rcvbuf) {