From patchwork Sat Jul 11 17:46:10 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Dykstra X-Patchwork-Id: 29702 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@bilbo.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from ozlabs.org (ozlabs.org [203.10.76.45]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mx.ozlabs.org", Issuer "CA Cert Signing Authority" (verified OK)) by bilbo.ozlabs.org (Postfix) with ESMTPS id 24DE7B6F1E for ; Sun, 12 Jul 2009 03:46:24 +1000 (EST) Received: by ozlabs.org (Postfix) id E8AA5DDDFA; Sun, 12 Jul 2009 03:46:24 +1000 (EST) Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 72DFADDDF7 for ; Sun, 12 Jul 2009 03:46:23 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751789AbZGKRqR (ORCPT ); Sat, 11 Jul 2009 13:46:17 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751734AbZGKRqQ (ORCPT ); Sat, 11 Jul 2009 13:46:16 -0400 Received: from mail-px0-f193.google.com ([209.85.216.193]:40323 "EHLO mail-px0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751676AbZGKRqP (ORCPT ); Sat, 11 Jul 2009 13:46:15 -0400 Received: by pxi31 with SMTP id 31so1118470pxi.33 for ; Sat, 11 Jul 2009 10:46:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:subject:from:to:content-type :date:message-id:mime-version:x-mailer:content-transfer-encoding; bh=kvw8Whq3pgrezgQXaUeHRYunoZgAX0qEmrQtXVTBIno=; b=a5B2CR+t7zFIM4V5eW99HvaGQjoIhdXVE7dc9pR7sq46GLprZtOFKFAS0nkg7TlEdy 773aKk82zfsBfl1b1U5ePy4Z/39Az9meIBW5tCEra3hzONdBsc5XmG2Q4T+80pmNScTu YRzEQ2seyZVXYuFm74KgngnakPkjMGumlkMRI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:content-type:date:message-id:mime-version:x-mailer :content-transfer-encoding; b=JddFlh8Ujf95hk4s8IWo+nV4lk11/o/9M64ReXI4sV/DLan1089Bh+14kAu9q9NCmu JdUMzu1FrpUNn71mAuFYSHmdRxvquc8GbwOQ2cmXK3yY3Y3ajOyMwG/SNpEhxlBp3O/u pbeExK0ov/SBdVh47LR2UCQU9IAGjUapqgjbg= Received: by 10.114.181.6 with SMTP id d6mr5440790waf.94.1247334375037; Sat, 11 Jul 2009 10:46:15 -0700 (PDT) Received: from ?192.168.221.201? ([24.118.80.156]) by mx.google.com with ESMTPS id l28sm4659784waf.19.2009.07.11.10.46.12 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sat, 11 Jul 2009 10:46:14 -0700 (PDT) Subject: [PATCH] net: Fix sk reference counting in ip_push_pending_frames and ip6_push_pending_frames From: John Dykstra To: netdev , eric.dumazet@gmail.com Date: Sat, 11 Jul 2009 17:46:10 +0000 Message-Id: <1247334370.7128.6.camel@Maple> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 "net: No more expensive sock_hold()/sock_put() on each tx" used sk_wmem_alloc rather than the struct sock reference count to track in-flight transmit-path packets. However, it missed the __sock_put() calls in ip_push_pending_frames() and ip6_push_pending_frames(). This results in too-small reference counts when UDP or RAW sockets are used to send more than one MTU of data. This in turn could lead to struct sock being freed and reused while it is still part of an active socket. A wide variety of socket symptoms may be fixed by this patch. It also fixes one cause of WARN_ON's in sk_del_node_init() and sk_nulls_del_node_init_rcu(). Signed-off-by: John Dykstra --- net/ipv4/ip_output.c | 1 - net/ipv6/ip6_output.c | 1 - 2 files changed, 0 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 2470262..7d08210 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1243,7 +1243,6 @@ int ip_push_pending_frames(struct sock *sk) skb->len += tmp_skb->len; skb->data_len += tmp_skb->len; skb->truesize += tmp_skb->truesize; - __sock_put(tmp_skb->sk); tmp_skb->destructor = NULL; tmp_skb->sk = NULL; } diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 7c76e3d..87f8419 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1484,7 +1484,6 @@ int ip6_push_pending_frames(struct sock *sk) skb->len += tmp_skb->len; skb->data_len += tmp_skb->len; skb->truesize += tmp_skb->truesize; - __sock_put(tmp_skb->sk); tmp_skb->destructor = NULL; tmp_skb->sk = NULL; }