Messages in this thread | ![/](/images/icornerl.gif) | | Subject | Re: a problem tcp_v4_err() | From | Eric Dumazet <> | Date | Fri, 12 Nov 2010 19:21:54 +0100 |
| |
Le vendredi 12 novembre 2010 à 19:12 +0100, Eric Dumazet a écrit : > Le vendredi 12 novembre 2010 à 20:57 +0300, Alexey Kuznetsov a écrit : > > Hello! > > > > I looked at tcp_v4_err() and found something strange. Quite non-trivial operations > > are performed on unlocked sockets. It looks like at least this BUG_ON(): > > > > skb = tcp_write_queue_head(sk); > > BUG_ON(!skb); > > > > can be easily triggered. > > > > Do I miss something? > > > > Hi Alexey ! > > I see socket is locked around line 368, > > bh_lock_sock(sk); > /* If too many ICMPs get dropped on busy > * servers this needs to be solved differently. > */ > if (sock_owned_by_user(sk)) > NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS); > > > Hmm, maybe some goto is missing ;) >
Well, goto is not missing.
Why do you think BUG_ON(!skb) can be triggered ?
We test before :
if (seq != tp->snd_una || !icsk->icsk_retransmits || !icsk->icsk_backoff) break;
So a concurrent user only can add new skb(s) in the (non empty) queue ?
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |