Eric Dumazet c3f9b01849 tcp: tcp_release_cb() should release socket ownership ...

Lars Persson reported following deadlock :

-000 |M:0x0:0x802B6AF8(asm) <-- arch_spin_lock
-001 |tcp_v4_rcv(skb = 0x8BD527A0) <-- sk = 0x8BE6B2A0
-002 |ip_local_deliver_finish(skb = 0x8BD527A0)
-003 |__netif_receive_skb_core(skb = 0x8BD527A0, ?)
-004 |netif_receive_skb(skb = 0x8BD527A0)
-005 |elk_poll(napi = 0x8C770500, budget = 64)
-006 |net_rx_action(?)
-007 |__do_softirq()
-008 |do_softirq()
-009 |local_bh_enable()
-010 |tcp_rcv_established(sk = 0x8BE6B2A0, skb = 0x87D3A9E0, th = 0x814EBE14, ?)
-011 |tcp_v4_do_rcv(sk = 0x8BE6B2A0, skb = 0x87D3A9E0)
-012 |tcp_delack_timer_handler(sk = 0x8BE6B2A0)
-013 |tcp_release_cb(sk = 0x8BE6B2A0)
-014 |release_sock(sk = 0x8BE6B2A0)
-015 |tcp_sendmsg(?, sk = 0x8BE6B2A0, ?, ?)
-016 |sock_sendmsg(sock = 0x8518C4C0, msg = 0x87D8DAA8, size = 4096)
-017 |kernel_sendmsg(?, ?, ?, ?, size = 4096)
-018 |smb_send_kvec()
-019 |smb_send_rqst(server = 0x87C4D400, rqst = 0x87D8DBA0)
-020 |cifs_call_async()
-021 |cifs_async_writev(wdata = 0x87FD6580)
-022 |cifs_writepages(mapping = 0x852096E4, wbc = 0x87D8DC88)
-023 |__writeback_single_inode(inode = 0x852095D0, wbc = 0x87D8DC88)
-024 |writeback_sb_inodes(sb = 0x87D6D800, wb = 0x87E4A9C0, work = 0x87D8DD88)
-025 |__writeback_inodes_wb(wb = 0x87E4A9C0, work = 0x87D8DD88)
-026 |wb_writeback(wb = 0x87E4A9C0, work = 0x87D8DD88)
-027 |wb_do_writeback(wb = 0x87E4A9C0, force_wait = 0)
-028 |bdi_writeback_workfn(work = 0x87E4A9CC)
-029 |process_one_work(worker = 0x8B045880, work = 0x87E4A9CC)
-030 |worker_thread(__worker = 0x8B045880)
-031 |kthread(_create = 0x87CADD90)
-032 |ret_from_kernel_thread(asm)

Bug occurs because __tcp_checksum_complete_user() enables BH, assuming
it is running from softirq context.

Lars trace involved a NIC without RX checksum support but other points
are problematic as well, like the prequeue stuff.

Problem is triggered by a timer, that found socket being owned by user.

tcp_release_cb() should call tcp_write_timer_handler() or
tcp_delack_timer_handler() in the appropriate context :

BH disabled and socket lock held, but 'owned' field cleared,
as if they were running from timer handlers.

Fixes: 6f458dfb4092 ("tcp: improve latencies of timer triggered events")
Reported-by: Lars Persson <lars.persson@axis.com>
Tested-by: Lars Persson <lars.persson@axis.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2014-03-11 16:45:59 -04:00

..

netfilter

netfilter: nf_nat_snmp_basic: fix duplicates in if/else branches

2014-02-14 11:37:36 +01:00

af_inet.c

ipv4: ipv6: better estimate tunnel header cut for correct ufo handling

2014-02-25 18:27:06 -05:00

ah4.c

ipv4: properly refresh rtable entries on pmtu/redirect events

2013-06-03 00:07:42 -07:00

arp.c

ipv4: arp: update neighbour address when a gratuitous arp is received and arp_accept is set

2014-01-02 00:08:38 -05:00

cipso_ipv4.c

ipv4: ERROR: code indent should use tabs where possible

2013-12-26 13:43:21 -05:00

datagram.c

net: Remove FLOWI_FLAG_CAN_SLEEP

2013-12-06 07:24:39 +01:00

devinet.c

ipv4: Fix runtime WARNING in rtmsg_ifa()

2014-02-06 20:02:15 -08:00

esp4.c

net: esp{4,6}: get rid of struct esp_data

2013-10-29 06:39:42 +01:00

fib_frontend.c

fib_frontend: fix possible NULL pointer dereference

2014-01-24 15:51:26 -08:00

fib_lookup.h

ipv4: make fib_detect_death static

2013-12-28 17:01:46 -05:00

fib_rules.c

inet: fix NULL pointer Oops in fib(6)_rule_suppress

2013-12-10 17:54:23 -05:00

fib_semantics.c

ipv4: make fib_detect_death static

2013-12-28 17:01:46 -05:00

fib_trie.c

seq_file: remove "%n" usage from seq_file users

2013-11-15 09:32:20 +09:00

gre_demux.c

gre_offload: statically build GRE offloading support

2014-01-06 20:28:34 -05:00

gre_offload.c

net/ipv4: don't use module_init in non-modular gre_offload

2014-01-16 16:08:27 -08:00

icmp.c

ipv4: introduce hardened ip_no_pmtu_disc mode

2014-01-13 11:22:55 -08:00

igmp.c

net: replace macros net_random and net_srandom with direct calls to prandom

2014-01-14 15:15:25 -08:00

inet_connection_sock.c

net: replace macros net_random and net_srandom with direct calls to prandom

2014-01-14 15:15:25 -08:00

inet_diag.c

inet_diag: fix inet_diag_dump_icsk() to use correct state for timewait sockets

2014-01-13 22:35:46 -08:00

inet_fragment.c

inet: frag: make sure forced eviction removes all frags

2014-03-06 15:28:45 -05:00

inet_hashtables.c

inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once

2013-10-19 19:45:35 -04:00

inet_lro.c

lro: remove dead code

2013-12-29 16:34:25 -05:00

inet_timewait_sock.c

tcp/dccp: remove twchain

2013-10-08 23:19:24 -04:00

inetpeer.c

ipv4: remove unused function

2013-12-28 17:03:20 -05:00

ip_forward.c

net: ip, ipv6: handle gso skbs in forwarding path

2014-02-13 17:17:02 -05:00

ip_fragment.c

net: Add utility functions to clear rxhash

2013-12-17 16:36:21 -05:00

ip_gre.c

net: gre: use icmp_hdr() to get inner ip header

2014-01-27 20:38:26 -08:00

ip_input.c

net: Fix memory leak if TPROXY used with TCP early demux

2014-01-27 16:22:11 -08:00

ip_options.c

ipv4: switch and case should be at the same indent

2014-01-02 03:30:36 -05:00

ip_output.c

netfilter: nf_tables: fix nf_trace always-on with XT_TRACE=n

2014-02-17 11:20:12 +01:00

ip_sockglue.c

ipv6: make IPV6_RECVPKTINFO work for ipv4 datagrams

2014-01-19 19:53:18 -08:00

ip_tunnel_core.c

ip_tunnel:multicast process cause panic due to skb->_skb_refdst NULL pointer

2014-03-03 15:56:40 -05:00

ip_tunnel.c

sit: fix panic with route cache in ip tunnels

2014-02-20 13:13:50 -05:00

ip_vti.c

ipv4: be friend with drop monitor

2014-01-18 23:08:02 -08:00

ipcomp.c

ipv4: properly refresh rtable entries on pmtu/redirect events

2013-06-03 00:07:42 -07:00

ipconfig.c

ipv4: ipconfig.c: add parentheses in an if statement

2014-02-14 00:14:23 -05:00

ipip.c

ipv4: be friend with drop monitor

2014-01-18 23:08:02 -08:00

ipmr.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-01-18 00:55:41 -08:00

Kconfig

net: neighbour: Remove CONFIG_ARPD

2013-09-03 21:41:43 -04:00

Makefile

gre_offload: statically build GRE offloading support

2014-01-06 20:28:34 -05:00

netfilter.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

ping.c

ipv6: protect protocols not handling ipv4 from v4 connection/bind attempts

2014-01-21 16:59:19 -08:00

proc.c

ipv4: spaces required around that '='

2014-01-02 03:30:36 -05:00

protocol.c

net: remove outdated comment for ipv4 and ipv6 protocol handler

2013-11-28 18:47:51 -05:00

raw.c

net: add build-time checks for msg->msg_name size

2014-01-18 23:04:16 -08:00

route.c

ipv4: fix counter in_slow_tot

2014-02-17 16:54:42 -05:00

syncookies.c

ipv4: fix checkpatch error "space prohibited"

2013-12-26 13:43:21 -05:00

sysctl_net_ipv4.c

ipv4: introduce ip_dst_mtu_maybe_forward and protect forwarding path against pmtu spoofing

2014-01-13 11:22:54 -08:00

tcp_bic.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_cong.c

tcp: reduce the bloat caused by tcp_is_cwnd_limited()

2014-02-24 19:13:38 -05:00

tcp_cubic.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_diag.c

…

tcp_fastopen.c

tcp: enable sockets to use MSG_FASTOPEN by default

2013-11-04 19:57:47 -05:00

tcp_highspeed.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_htcp.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_hybla.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_illinois.c

remove extra definitions of U32_MAX

2014-01-23 16:36:55 -08:00

tcp_input.c

tcp: fix bogus RTT on special retransmission

2014-03-03 15:33:02 -05:00

tcp_ipv4.c

tcp: delete redundant calls of tcp_mtup_init()

2014-01-21 16:52:31 -08:00

tcp_lp.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_memcontrol.c

tcp_memcontrol: Cleanup/fix cg_proto->memory_pressure handling.

2013-12-05 21:01:01 -05:00

tcp_metrics.c

tcp: metrics: Handle v6/v4-mapped sockets in tcp-metrics

2014-01-23 12:48:28 -08:00

tcp_minisocks.c

ipv6: tcp: fix flowlabel value in ACK messages send from TIME_WAIT

2014-01-17 17:56:33 -08:00

tcp_offload.c

tcp: do not export tcp_gso_segment() and tcp_gro_receive()

2014-01-14 18:53:48 -08:00

tcp_output.c

tcp: tcp_release_cb() should release socket ownership

2014-03-11 16:45:59 -04:00

tcp_probe.c

ipv4: ERROR: do not initialise globals to 0 or NULL

2013-12-26 13:43:21 -05:00

tcp_scalable.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_timer.c

tcp: temporarily disable Fast Open on SYN timeout

2013-10-29 22:50:41 -04:00

tcp_vegas.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_vegas.h

net: ipv4/ipv6: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

tcp_veno.c

tcp: properly handle stretch acks in slow start

2013-11-04 19:57:59 -05:00

tcp_westwood.c

tcp: refactor F-RTO

2013-03-21 11:47:50 -04:00

tcp_yeah.c

ipv4: ipv4: Cleanup the comments in tcp_yeah.c

2013-12-26 13:43:55 -05:00

tcp.c

net-tcp: fastopen: fix high order allocations

2014-02-22 00:05:21 -05:00

tunnel4.c

net: Convert printks to pr_<level>

2012-03-11 23:42:51 -07:00

udp_diag.c

netlink: rename ssk to sk in struct netlink_skb_params

2013-04-19 14:57:56 -04:00

udp_impl.h

net: ipv4/ipv6: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

udp_offload.c

net/ipv4: Use proper RCU APIs for writer-side in udp_offload.c

2014-02-04 20:01:55 -08:00

udp.c

net: add build-time checks for msg->msg_name size

2014-01-18 23:04:16 -08:00

udplite.c

net: ipv4: Standardize prefixes for message logging

2012-03-12 17:05:21 -07:00

xfrm4_input.c

net: Add skb_unclone() helper function.

2013-02-15 15:10:37 -05:00

xfrm4_mode_beet.c

ipv4: ERROR: code indent should use tabs where possible

2013-12-26 13:43:21 -05:00

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2013-09-30 15:24:57 -04:00

xfrm4_output.c

xfrm: revert ipv4 mtu determination to dst_mtu

2013-08-26 12:40:53 +02:00

xfrm4_policy.c

xfrm: Fix null pointer dereference when decoding sessions

2013-11-01 07:08:46 +01:00

xfrm4_state.c

inet: make no_pmtu_disc per namespace and kill ipv4_config

2013-12-18 16:58:20 -05:00

xfrm4_tunnel.c

sit: add IPv4 over IPv4 support

2013-05-31 17:19:05 -07:00