Messages in this thread | ![/](/images/icornerl.gif) | | Subject | Re: a problem tcp_v4_err() | From | Eric Dumazet <> | Date | Fri, 12 Nov 2010 19:27:57 +0100 |
| |
Le vendredi 12 novembre 2010 à 19:21 +0100, Eric Dumazet a écrit : > Le vendredi 12 novembre 2010 à 19:12 +0100, Eric Dumazet a écrit : > > Le vendredi 12 novembre 2010 à 20:57 +0300, Alexey Kuznetsov a écrit : > > > Hello! > > > > > > I looked at tcp_v4_err() and found something strange. Quite non-trivial operations > > > are performed on unlocked sockets. It looks like at least this BUG_ON(): > > > > > > skb = tcp_write_queue_head(sk); > > > BUG_ON(!skb); > > > > > > can be easily triggered. > > > > > > Do I miss something? > > > > > > > Hi Alexey ! > > > > I see socket is locked around line 368, > > > > bh_lock_sock(sk); > > /* If too many ICMPs get dropped on busy > > * servers this needs to be solved differently. > > */ > > if (sock_owned_by_user(sk)) > > NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS); > > > > > > Hmm, maybe some goto is missing ;) > > > > Well, goto is not missing. > > Why do you think BUG_ON(!skb) can be triggered ? > > We test before : > > if (seq != tp->snd_una || !icsk->icsk_retransmits || > !icsk->icsk_backoff) > break; > > So a concurrent user only can add new skb(s) in the (non empty) queue ? > >
Oh well, it seems you are right (backlog processing)
Bug was introduced in commit f1ecd5d9e736660 (Revert Backoff [v3]: Revert RTO on ICMP destination unreachable) from Damian Lukowski
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |