lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 068/172] tcp: tcp_rtx_synack() can be called from process context
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit 0a375c822497ed6ad6b5da0792a12a6f1af10c0b ]

    Laurent reported the enclosed report [1]

    This bug triggers with following coditions:

    0) Kernel built with CONFIG_DEBUG_PREEMPT=y

    1) A new passive FastOpen TCP socket is created.
    This FO socket waits for an ACK coming from client to be a complete
    ESTABLISHED one.
    2) A socket operation on this socket goes through lock_sock()
    release_sock() dance.
    3) While the socket is owned by the user in step 2),
    a retransmit of the SYN is received and stored in socket backlog.
    4) At release_sock() time, the socket backlog is processed while
    in process context.
    5) A SYNACK packet is cooked in response of the SYN retransmit.
    6) -> tcp_rtx_synack() is called in process context.

    Before blamed commit, tcp_rtx_synack() was always called from BH handler,
    from a timer handler.

    Fix this by using TCP_INC_STATS() & NET_INC_STATS()
    which do not assume caller is in non preemptible context.

    [1]
    BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180
    caller is tcp_rtx_synack.part.0+0x36/0xc0
    CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1
    Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021
    Call Trace:
    <TASK>
    dump_stack_lvl+0x48/0x5e
    check_preemption_disabled+0xde/0xe0
    tcp_rtx_synack.part.0+0x36/0xc0
    tcp_rtx_synack+0x8d/0xa0
    ? kmem_cache_alloc+0x2e0/0x3e0
    ? apparmor_file_alloc_security+0x3b/0x1f0
    inet_rtx_syn_ack+0x16/0x30
    tcp_check_req+0x367/0x610
    tcp_rcv_state_process+0x91/0xf60
    ? get_nohz_timer_target+0x18/0x1a0
    ? lock_timer_base+0x61/0x80
    ? preempt_count_add+0x68/0xa0
    tcp_v4_do_rcv+0xbd/0x270
    __release_sock+0x6d/0xb0
    release_sock+0x2b/0x90
    sock_setsockopt+0x138/0x1140
    ? __sys_getsockname+0x7e/0xc0
    ? aa_sk_perm+0x3e/0x1a0
    __sys_setsockopt+0x198/0x1e0
    __x64_sys_setsockopt+0x21/0x30
    do_syscall_64+0x38/0xc0
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Laurent Fasnacht <laurent.fasnacht@proton.ch>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Link: https://lore.kernel.org/r/20220530213713.601888-1-eric.dumazet@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/tcp_output.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    index e37ad0b3645c..8634a5c853f5 100644
    --- a/net/ipv4/tcp_output.c
    +++ b/net/ipv4/tcp_output.c
    @@ -4115,8 +4115,8 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req)
    res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL,
    NULL);
    if (!res) {
    - __TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
    - __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
    + TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
    + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
    if (unlikely(tcp_passive_fastopen(sk)))
    tcp_sk(sk)->total_retrans++;
    trace_tcp_retransmit_synack(sk, req);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 14:36    [W:4.176 / U:0.192 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site