Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1311336 > unrolled thread

[PATCH] af_packet: Raw socket destruction warning fix

Back to article view | Back to linux.kernel

Contents

  [PATCH] af_packet: Raw socket destruction warning fix Maninder Singh <maninder1.s@samsung.com> - 2016-01-18 07:40 +0100
    Re: [PATCH] af_packet: Raw socket destruction warning fix Daniel Borkmann <daniel@iogearbox.net> - 2016-01-18 10:50 +0100
      Re: [PATCH] af_packet: Raw socket destruction warning fix Daniel Borkmann <daniel@iogearbox.net> - 2016-01-18 11:30 +0100

#1311336 — [PATCH] af_packet: Raw socket destruction warning fix

Receieve queue is not purged when socket dectruction is called
results in kernel warning because of non zero sk_rmem_alloc.

WARNING: at net/packet/af_packet.c:1142 packet_sock_destruct

Backtrace:
WARN_ON(atomic_read(&sk->sk_rmem_alloc)
packet_sock_destruct
__sk_free
sock_wfree
skb_release_head_state
skb_release_all
__kfree_skb
net_tx_action
__do_softirq
run_ksoftirqd

Signed-off-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
---
 net/packet/af_packet.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 81b4b81..bcb37ba 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1310,6 +1310,7 @@ static bool packet_rcv_has_room(struct packet_sock *po, struct sk_buff *skb)
 
 static void packet_sock_destruct(struct sock *sk)
 {
+	skb_queue_purge(&sk->sk_receive_queue);
 	skb_queue_purge(&sk->sk_error_queue);
 
 	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
-- 
1.7.9.5

[toc] | [next] | [standalone]

#1311428

On 01/18/2016 07:37 AM, Maninder Singh wrote:
> Receieve queue is not purged when socket dectruction is called
> results in kernel warning because of non zero sk_rmem_alloc.
>
> WARNING: at net/packet/af_packet.c:1142 packet_sock_destruct
>
> Backtrace:
> WARN_ON(atomic_read(&sk->sk_rmem_alloc)
> packet_sock_destruct
> __sk_free
> sock_wfree
> skb_release_head_state
> skb_release_all
> __kfree_skb
> net_tx_action
> __do_softirq
> run_ksoftirqd
>
> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>

Thanks for the fix. While it fixes the WARN_ON(), I believe some more
investigation is needed here on why it is happening:

We call first into packet_release(), which removes the socket hook from
the kernel (unregister_prot_hook()), later calls synchronize_net() to
make sure no more skbs will come in. The receive queue is purged right
after the synchronize_net() already.

packet_sock_destruct() will be called afterwards, when there are no more
refs on the socket anymore and no af_packet skbs in tx waiting for completion.
Only then, in sk_destruct(), we'll call into packet_sock_destruct().

So, eventually double purging the sk_receive_queue seems not the right
thing to do at first look, and w/o any deeper analysis in the commit description.

Could you look a bit further into the issue? Do you have a reproducer to
trigger it?

Thanks,
Daniel

> ---
>   net/packet/af_packet.c |    1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 81b4b81..bcb37ba 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -1310,6 +1310,7 @@ static bool packet_rcv_has_room(struct packet_sock *po, struct sk_buff *skb)
>
>   static void packet_sock_destruct(struct sock *sk)
>   {
> +	skb_queue_purge(&sk->sk_receive_queue);
>   	skb_queue_purge(&sk->sk_error_queue);
>
>   	WARN_ON(atomic_read(&sk->sk_rmem_alloc));
>

[toc] | [prev] | [next] | [standalone]

#1311458

On 01/18/2016 10:44 AM, Daniel Borkmann wrote:
> On 01/18/2016 07:37 AM, Maninder Singh wrote:
>> Receieve queue is not purged when socket dectruction is called
>> results in kernel warning because of non zero sk_rmem_alloc.
>>
>> WARNING: at net/packet/af_packet.c:1142 packet_sock_destruct
>>
>> Backtrace:
>> WARN_ON(atomic_read(&sk->sk_rmem_alloc)
>> packet_sock_destruct
>> __sk_free
>> sock_wfree
>> skb_release_head_state
>> skb_release_all
>> __kfree_skb
>> net_tx_action
>> __do_softirq
>> run_ksoftirqd
>>
>> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
>> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
>
> Thanks for the fix. While it fixes the WARN_ON(), I believe some more
> investigation is needed here on why it is happening:
>
> We call first into packet_release(), which removes the socket hook from
> the kernel (unregister_prot_hook()), later calls synchronize_net() to
> make sure no more skbs will come in. The receive queue is purged right
> after the synchronize_net() already.
>
> packet_sock_destruct() will be called afterwards, when there are no more
> refs on the socket anymore and no af_packet skbs in tx waiting for completion.

(...and in your above case, there seem to have been some skbs in tx from
{t,}packet_snd(), as we call __sk_free() via kfree_skb() (-> sock_wfree()).)

> Only then, in sk_destruct(), we'll call into packet_sock_destruct().
>
> So, eventually double purging the sk_receive_queue seems not the right
> thing to do at first look, and w/o any deeper analysis in the commit description.
>
> Could you look a bit further into the issue? Do you have a reproducer to
> trigger it?
>
> Thanks,
> Daniel

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web