From patchwork Sat Sep 11 05:42:55 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Willy Tarreau X-Patchwork-Id: 64485 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 850F1B70A5 for ; Sat, 11 Sep 2010 15:44:17 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751488Ab0IKFn0 (ORCPT ); Sat, 11 Sep 2010 01:43:26 -0400 Received: from 1wt.eu ([62.212.114.60]:44321 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750801Ab0IKFn0 (ORCPT ); Sat, 11 Sep 2010 01:43:26 -0400 Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id o8B5gtw4031549; Sat, 11 Sep 2010 07:42:55 +0200 Date: Sat, 11 Sep 2010 07:42:55 +0200 From: Willy Tarreau To: David Miller , Greg KH Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@kernel.org Subject: tcp collapse+splice bug still present in -stable Message-ID: <20100911054255.GB29288@1wt.eu> Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.4.2.3i Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org David, Greg, one of our customers was encountering frequent kernel panics up to 2.6.32.21 that were always related to splicing and tcp_collapse(). I found the precise BUG_ON() line but I've not forgotten it, something about ->seq not being OK. I found the following fix in 2.6.35 which looked to be related to the same issue, and we could verify that it definitely solves it. Could we please have it in other stable versions ? Thanks in advance, Willy --- From baff42ab1494528907bf4d5870359e31711746ae Mon Sep 17 00:00:00 2001 From: Steven J. Magnani Date: Tue, 30 Mar 2010 13:56:01 -0700 Subject: [PATCH] net: Fix oops from tcp_collapse() when using splice() tcp_read_sock() can have a eat skbs without immediately advancing copied_seq. This can cause a panic in tcp_collapse() if it is called as a result of the recv_actor dropping the socket lock. A userspace program that splices data from a socket to either another socket or to a file can trigger this bug. Signed-off-by: Steven J. Magnani Signed-off-by: David S. Miller -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 6afb6d8..2c75f89 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1368,6 +1368,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, sk_eat_skb(sk, skb, 0); if (!desc->count) break; + tp->copied_seq = seq; } tp->copied_seq = seq;