From patchwork Wed Dec 21 13:42:43 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 707809 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3tkG7H6FVvz9t0m for ; Thu, 22 Dec 2016 00:42:50 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="nC5CoiX4"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758959AbcLUNmq (ORCPT ); Wed, 21 Dec 2016 08:42:46 -0500 Received: from mail-pg0-f68.google.com ([74.125.83.68]:36173 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758444AbcLUNmp (ORCPT ); Wed, 21 Dec 2016 08:42:45 -0500 Received: by mail-pg0-f68.google.com with SMTP id w68so10386180pgw.3 for ; Wed, 21 Dec 2016 05:42:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=zeWGvyupSJfs6etLDvOxMhuT8Q6ZC7lRUcykLpuCYQw=; b=nC5CoiX45bHXrqvC6J/fTDFKA+bvgwgLazonlJBaEX4C9oePnFmEVhGs3d+Z0tE+Px JB63RnFLUd8Ui9/zZHURTrKplcys5Ur1YaNNki6DTTuEcNoyreio+MVwOfYj2nhtUBuh JVebdXRvHOii+65hhba+8gtEUzOgJ3Kr4r4wfU97rYgD7Zhp98+7vrWqz6AihVRkhzJl Ggck/MCtjjqugKbxiF9WUs1MrKMLZi8lf/+IYTM6aNx2e1T991J2u0ch4IIAp3mZop0b 7edTuOL3+mpjdt+mphBqfpKEYvJ5dcukn2sX2yAfqjMhLB6LAh1ji+BkflGLt/2+7WeY 0LGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=zeWGvyupSJfs6etLDvOxMhuT8Q6ZC7lRUcykLpuCYQw=; b=Em1T9gI3MacjLaZiHzrI1qzxjU9jKB8Dt6gmT19TliHi0WkovPYazlgGyiiuYudAmw 39yeqsVlpa+QYnMYynaFkWfKKt89VN0Wpydr/kV+SmCywff/pa0SAWVw8eTW/2106PsF dO6xbblCHH8S3s3JkVsF/8QpH/QEHCi6WhIXKwazcXF8VL0bpnmvxjIaf3UP6f0LQ7iw KLn2PxN5+GkVQak8rp5EXJLVBXDQe3S39ybAzEEW4ru9VZQozOVlQHmEcselY+KRqPRh XGbkg/6ujx7rIBODqBtcZ5+dmHepVwAkGHQFC9HjmAHJTdChLcTSgJcedGYcSrZsSBDX 58Ow== X-Gm-Message-State: AIkVDXLSBwib+1V5Fn3ZEoFq2IRXOsoiQnD3Yp+3qrZoQAyUtDf7iQZgq/GFfQnem7dwrw== X-Received: by 10.84.141.129 with SMTP id 1mr9028051plv.102.1482327764432; Wed, 21 Dec 2016 05:42:44 -0800 (PST) Received: from [172.29.161.236] ([172.29.161.236]) by smtp.googlemail.com with ESMTPSA id t15sm3140353pgn.18.2016.12.21.05.42.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Dec 2016 05:42:44 -0800 (PST) Message-ID: <1482327763.8944.26.camel@edumazet-glaptop3.roam.corp.google.com> Subject: [PATCH net] tcp: add a missing barrier in tcp_tasklet_func() From: Eric Dumazet To: David Miller Cc: netdev , Eric Dumazet , Madalin Bucur Date: Wed, 21 Dec 2016 05:42:43 -0800 X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet Madalin reported crashes happening in tcp_tasklet_func() on powerpc64 Before TSQ_QUEUED bit is cleared, we must ensure the changes done by list_del(&tp->tsq_node); are committed to memory, otherwise corruption might happen, as an other cpu could catch TSQ_QUEUED clearance too soon. We can notice that old kernels were immune to this bug, because TSQ_QUEUED was cleared after a bh_lock_sock(sk)/bh_unlock_sock(sk) section, but they could have missed a kick to write additional bytes, when NIC interrupts for a given flow are spread to multiple cpus. Affected TCP flows would need an incoming ACK or RTO timer to add more packets to the pipe. So overall situation should be better now. Fixes: b223feb9de2a ("tcp: tsq: add shortcut in tcp_tasklet_func()") Signed-off-by: Eric Dumazet Reported-by: Madalin Bucur Tested-by: Madalin Bucur Tested-by: Xing Lei --- net/ipv4/tcp_output.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index b45101f3d2bd2e0f0077305a061add4f7ea0de27..31a255b555ad86a3537c077862e3ea38f9b44284 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -769,6 +769,7 @@ static void tcp_tasklet_func(unsigned long data) list_del(&tp->tsq_node); sk = (struct sock *)tp; + smp_mb__before_atomic(); clear_bit(TSQ_QUEUED, &sk->sk_tsq_flags); if (!sk->sk_lock.owned &&