Re: [PATCH] af_packet: Raw socket destruction warning fix

Path	csiph.com!news.mixmin.net!weretis.net!feeder1.news.weretis.net!newsfeed.CARNet.hr!news.spin.it!bofh.it!news.nic.it!robomod
From	Daniel Borkmann <daniel@iogearbox.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH] af_packet: Raw socket destruction warning fix
Date	Mon, 18 Jan 2016 11:30:01 +0100
Message-ID	<qSfep-7L5-5@gated-at.bofh.it> (permalink)
References	<qSbDQ-5ho-9@gated-at.bofh.it> <qSeBI-7bZ-21@gated-at.bofh.it>
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version	1.0
Content-Type	text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding	7bit
X-Authenticated-Sender	daniel@iogearbox.net
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	46
Organization	linux.* mail to news gateway
X-Original-Cc	davem@davemloft.net, willemb@google.com, edumazet@google.com, eyal.birger@gmail.com, tklauser@distanz.ch, fruggeri@aristanetworks.com, dwmw2@infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, pankaj.m@samsung.com, gh007.kim@samsung.com, hakbong5.lee@samsung.com, Vaneet Narang <v.narang@samsung.com>
X-Original-Date	Mon, 18 Jan 2016 11:29:26 +0100
X-Original-Message-ID	<569CBE86.8030107@iogearbox.net>
X-Original-References	<1453099068-39022-1-git-send-email-maninder1.s@samsung.com> <569CB419.6050102@iogearbox.net>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1311458

Show key headers only | View raw

On 01/18/2016 10:44 AM, Daniel Borkmann wrote:
> On 01/18/2016 07:37 AM, Maninder Singh wrote:
>> Receieve queue is not purged when socket dectruction is called
>> results in kernel warning because of non zero sk_rmem_alloc.
>>
>> WARNING: at net/packet/af_packet.c:1142 packet_sock_destruct
>>
>> Backtrace:
>> WARN_ON(atomic_read(&sk->sk_rmem_alloc)
>> packet_sock_destruct
>> __sk_free
>> sock_wfree
>> skb_release_head_state
>> skb_release_all
>> __kfree_skb
>> net_tx_action
>> __do_softirq
>> run_ksoftirqd
>>
>> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
>> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
>
> Thanks for the fix. While it fixes the WARN_ON(), I believe some more
> investigation is needed here on why it is happening:
>
> We call first into packet_release(), which removes the socket hook from
> the kernel (unregister_prot_hook()), later calls synchronize_net() to
> make sure no more skbs will come in. The receive queue is purged right
> after the synchronize_net() already.
>
> packet_sock_destruct() will be called afterwards, when there are no more
> refs on the socket anymore and no af_packet skbs in tx waiting for completion.

(...and in your above case, there seem to have been some skbs in tx from
{t,}packet_snd(), as we call __sk_free() via kfree_skb() (-> sock_wfree()).)

> Only then, in sk_destruct(), we'll call into packet_sock_destruct().
>
> So, eventually double purging the sk_receive_queue seems not the right
> thing to do at first look, and w/o any deeper analysis in the commit description.
>
> Could you look a bit further into the issue? Do you have a reproducer to
> trigger it?
>
> Thanks,
> Daniel

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] af_packet: Raw socket destruction warning fix Maninder Singh <maninder1.s@samsung.com> - 2016-01-18 07:40 +0100
  Re: [PATCH] af_packet: Raw socket destruction warning fix Daniel Borkmann <daniel@iogearbox.net> - 2016-01-18 10:50 +0100
    Re: [PATCH] af_packet: Raw socket destruction warning fix Daniel Borkmann <daniel@iogearbox.net> - 2016-01-18 11:30 +0100

csiph-web