linux-stable.git/net/ipv4/tcp_timer.c, branch linux-3.6.y

tcp: fix possible socket refcount problem

2012-08-21T21:42:23+00:00

Commit 6f458dfb40 (tcp: improve latencies of timer triggered events)
added bug leading to following trace :

[ 2866.131281] IPv4: Attempt to release TCP socket in state 1 ffff880019ec0000
[ 2866.131726]
[ 2866.132188] =========================
[ 2866.132281] [ BUG: held lock freed! ]
[ 2866.132281] 3.6.0-rc1+ #622 Not tainted
[ 2866.132281] -------------------------
[ 2866.132281] kworker/0:1/652 is freeing memory ffff880019ec0000-ffff880019ec0a1f, with a lock still held there!
[ 2866.132281]  (sk_lock-AF_INET-RPC){+.+...}, at: [] tcp_sendmsg+0x29/0xcc6
[ 2866.132281] 4 locks held by kworker/0:1/652:
[ 2866.132281]  #0:  (rpciod){.+.+.+}, at: [] process_one_work+0x1de/0x47f
[ 2866.132281]  #1:  ((&task->u.tk_work)){+.+.+.}, at: [] process_one_work+0x1de/0x47f
[ 2866.132281]  #2:  (sk_lock-AF_INET-RPC){+.+...}, at: [] tcp_sendmsg+0x29/0xcc6
[ 2866.132281]  #3:  (&icsk->icsk_retransmit_timer){+.-...}, at: [] run_timer_softirq+0x1ad/0x35f
[ 2866.132281]
[ 2866.132281] stack backtrace:
[ 2866.132281] Pid: 652, comm: kworker/0:1 Not tainted 3.6.0-rc1+ #622
[ 2866.132281] Call Trace:
[ 2866.132281]    [] debug_check_no_locks_freed+0x112/0x159
[ 2866.132281]  [] ? __sk_free+0xfd/0x114
[ 2866.132281]  [] kmem_cache_free+0x6b/0x13a
[ 2866.132281]  [] __sk_free+0xfd/0x114
[ 2866.132281]  [] sk_free+0x1c/0x1e
[ 2866.132281]  [] tcp_write_timer+0x51/0x56
[ 2866.132281]  [] run_timer_softirq+0x218/0x35f
[ 2866.132281]  [] ? run_timer_softirq+0x1ad/0x35f
[ 2866.132281]  [] ? rb_commit+0x58/0x85
[ 2866.132281]  [] ? tcp_write_timer_handler+0x148/0x148
[ 2866.132281]  [] __do_softirq+0xcb/0x1f9
[ 2866.132281]  [] ? _raw_spin_unlock+0x29/0x2e
[ 2866.132281]  [] call_softirq+0x1c/0x30
[ 2866.132281]  [] do_softirq+0x4a/0xa6
[ 2866.132281]  [] irq_exit+0x51/0xad
[ 2866.132281]  [] do_IRQ+0x9d/0xb4
[ 2866.132281]  [] common_interrupt+0x6f/0x6f
[ 2866.132281]    [] ? sched_clock_cpu+0x58/0xd1
[ 2866.132281]  [] ? _raw_spin_unlock_irqrestore+0x4c/0x56
[ 2866.132281]  [] mod_timer+0x178/0x1a9
[ 2866.132281]  [] sk_reset_timer+0x19/0x26
[ 2866.132281]  [] tcp_rearm_rto+0x99/0xa4
[ 2866.132281]  [] tcp_event_new_data_sent+0x6e/0x70
[ 2866.132281]  [] tcp_write_xmit+0x7de/0x8e4
[ 2866.132281]  [] ? __alloc_skb+0xa0/0x1a1
[ 2866.132281]  [] __tcp_push_pending_frames+0x2e/0x8a
[ 2866.132281]  [] tcp_sendmsg+0xb32/0xcc6
[ 2866.132281]  [] inet_sendmsg+0xaa/0xd5
[ 2866.132281]  [] ? inet_autobind+0x5f/0x5f
[ 2866.132281]  [] ? trace_clock_local+0x9/0xb
[ 2866.132281]  [] sock_sendmsg+0xa3/0xc4
[ 2866.132281]  [] ? rb_reserve_next_event+0x26f/0x2d5
[ 2866.132281]  [] ? native_sched_clock+0x29/0x6f
[ 2866.132281]  [] ? sched_clock+0x9/0xd
[ 2866.132281]  [] ? trace_clock_local+0x9/0xb
[ 2866.132281]  [] kernel_sendmsg+0x37/0x43
[ 2866.132281]  [] xs_send_kvec+0x77/0x80
[ 2866.132281]  [] xs_sendpages+0x6f/0x1a0
[ 2866.132281]  [] ? try_to_del_timer_sync+0x55/0x61
[ 2866.132281]  [] xs_tcp_send_request+0x55/0xf1
[ 2866.132281]  [] xprt_transmit+0x89/0x1db
[ 2866.132281]  [] ? call_connect+0x3c/0x3c
[ 2866.132281]  [] call_transmit+0x1c5/0x20e
[ 2866.132281]  [] __rpc_execute+0x6f/0x225
[ 2866.132281]  [] ? call_connect+0x3c/0x3c
[ 2866.132281]  [] rpc_async_schedule+0x28/0x34
[ 2866.132281]  [] process_one_work+0x24d/0x47f
[ 2866.132281]  [] ? process_one_work+0x1de/0x47f
[ 2866.132281]  [] ? __rpc_execute+0x225/0x225
[ 2866.132281]  [] worker_thread+0x236/0x317
[ 2866.132281]  [] ? process_scheduled_works+0x2f/0x2f
[ 2866.132281]  [] kthread+0x9a/0xa2
[ 2866.132281]  [] kernel_thread_helper+0x4/0x10
[ 2866.132281]  [] ? retint_restore_args+0x13/0x13
[ 2866.132281]  [] ? __init_kthread_worker+0x5a/0x5a
[ 2866.132281]  [] ? gs_change+0x13/0x13
[ 2866.308506] IPv4: Attempt to release TCP socket in state 1 ffff880019ec0000
[ 2866.309689] =============================================================================
[ 2866.310254] BUG TCP (Not tainted): Object already free
[ 2866.310254] -----------------------------------------------------------------------------
[ 2866.310254]

The bug comes from the fact that timer set in sk_reset_timer() can run
before we actually do the sock_hold(). socket refcount reaches zero and
we free the socket too soon.

timer handler is not allowed to reduce socket refcnt if socket is owned
by the user, or we need to change sk_reset_timer() implementation.

We should take a reference on the socket in case TCP_DELACK_TIMER_DEFERRED
or TCP_DELACK_TIMER_DEFERRED bit are set in tsq_flags

Also fix a typo in tcp_delack_timer(), where TCP_WRITE_TIMER_DEFERRED
was used instead of TCP_DELACK_TIMER_DEFERRED.

For consistency, use same socket refcount change for TCP_MTU_REDUCED_DEFERRED,
even if not fired from a timer.

Reported-by: Fengguang Wu 
Tested-by: Fengguang Wu 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

tcp: improve latencies of timer triggered events

2012-07-20T17:59:41+00:00

Modern TCP stack highly depends on tcp_write_timer() having a small
latency, but current implementation doesn't exactly meet the
expectations.

When a timer fires but finds the socket is owned by the user, it rearms
itself for an additional delay hoping next run will be more
successful.

tcp_write_timer() for example uses a 50ms delay for next try, and it
defeats many attempts to get predictable TCP behavior in term of
latencies.

Use the recently introduced tcp_release_cb(), so that the user owning
the socket will call various handlers right before socket release.

This will permit us to post a followup patch to address the
tcp_tso_should_defer() syndrome (some deferred packets have to wait
RTO timer to be transmitted, while cwnd should allow us to send them
sooner)

Signed-off-by: Eric Dumazet 
Cc: Tom Herbert 
Cc: Yuchung Cheng 
Cc: Neal Cardwell 
Cc: Nandita Dukkipati 
Cc: H.K. Jerry Chu 
Cc: John Heffner 
Signed-off-by: David S. Miller

tcp: early retransmit: delayed fast retransmit

2012-05-03T00:56:10+00:00

Implementing the advanced early retransmit (sysctl_tcp_early_retrans==2).
Delays the fast retransmit by an interval of RTT/4. We borrow the
RTO timer to implement the delay. If we receive another ACK or send
a new packet, the timer is cancelled and restored to original RTO
value offset by time elapsed.  When the delayed-ER timer fires,
we enter fast recovery and perform fast retransmit.

Signed-off-by: Yuchung Cheng 
Acked-by: Neal Cardwell 
Signed-off-by: David S. Miller

net: ipv4: Standardize prefixes for message logging

2012-03-13T00:05:21+00:00

Add #define pr_fmt(fmt) as appropriate.

Add "IPv4: ", "TCP: ", and "IPsec: " to appropriate files.
Standardize on "UDPLite: " for appropriate uses.
Some prefixes were previously "UDPLITE: " and "UDP-Lite: ".

Add KBUILD_MODNAME ": " to icmp and gre.
Remove embedded prefixes as appropriate.

Add missing "\n" to pr_info in gre.c.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

net: Disambiguate kernel message

2012-02-01T19:41:50+00:00

Some of our machines were reporting:

TCP: too many of orphaned sockets

even when the number of orphaned sockets was well below the
limit.

We print a different message depending on whether we're out
of TCP memory or there are too many orphaned sockets.

Also move the check out of line and cleanup the messages
that were printed.

Signed-off-by: Arun Sharma 
Suggested-by: Mohan Srinivasan 
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: David Miller 
Cc: Glauber Costa 
Cc: Ingo Molnar 
Cc: Joe Perches 
Signed-off-by: David S. Miller

net: fix assignment of 0/1 to bool variables.

2011-12-20T03:27:29+00:00

DaveM said:
   Please, this kind of stuff rots forever and not using bool properly
   drives me crazy.

Joe Perches  gave me the spatch script:

	@@
	bool b;
	@@
	-b = 0
	+b = false
	@@
	bool b;
	@@
	-b = 1
	+b = true

I merely installed coccinelle, read the documentation and took credit.

Signed-off-by: Rusty Russell 
Signed-off-by: David S. Miller

foundations of per-cgroup memory pressure controlling.

2011-12-13T00:04:10+00:00

This patch replaces all uses of struct sock fields' memory_pressure,
memory_allocated, sockets_allocated, and sysctl_mem to acessor
macros. Those macros can either receive a socket argument, or a mem_cgroup
argument, depending on the context they live in.

Since we're only doing a macro wrapping here, no performance impact at all is
expected in the case where we don't have cgroups disabled.

Signed-off-by: Glauber Costa 
Reviewed-by: Hiroyouki Kamezawa 
CC: David S. Miller 
CC: Eric W. Biederman 
CC: Eric Dumazet 
Signed-off-by: David S. Miller

net: use IS_ENABLED(CONFIG_IPV6)

2011-12-11T23:25:16+00:00

Instead of testing defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

TCP: remove TCP_DEBUG

2011-10-24T21:36:08+00:00

It was enabled by default and the messages guarded
by the define are useful.

Signed-off-by: Flavio Leitner 
Signed-off-by: David S. Miller

tcp: Remove debug macro of TCP_CHECK_TIMER

2011-02-20T19:10:14+00:00

Now, TCP_CHECK_TIMER is not used for debuging, it does nothing.
And, it has been there for several years, maybe 6 years.

Remove it to keep code clearer.

Signed-off-by: Shan Wei 
Signed-off-by: David S. Miller