From: Vaneet Narang <v.narang@samsung.com>
To: Daniel Borkmann <daniel@iogearbox.net>,
Maninder Singh <maninder1.s@samsung.com>
Cc: "davem@davemloft.net" <davem@davemloft.net>,
"willemb@google.com" <willemb@google.com>,
"edumazet@google.com" <edumazet@google.com>,
"eyal.birger@gmail.com" <eyal.birger@gmail.com>,
"tklauser@distanz.ch" <tklauser@distanz.ch>,
"fruggeri@aristanetworks.com" <fruggeri@aristanetworks.com>,
"dwmw2@infradead.org" <dwmw2@infradead.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
PANKAJ MISHRA <pankaj.m@samsung.com>,
Geon-ho Kim <gh007.kim@samsung.com>,
Hak-Bong Lee <hakbong5.lee@samsung.com>
Subject: Re: [PATCH] af_packet: Raw socket destruction warning fix
Date: Mon, 18 Jan 2016 10:11:05 +0000 (GMT) [thread overview]
Message-ID: <1385051583.176751453111860930.JavaMail.weblogic@ep2mlwas01a> (raw)
Hi,
>> __do_softirq
>> run_ksoftirqd
>>
>> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
>> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
> Thanks for the fix. While it fixes the WARN_ON(), I believe some more
> investigation is needed here on why it is happening:
>
> We call first into packet_release(), which removes the socket hook from
> the kernel (unregister_prot_hook()), later calls synchronize_net() to
> make sure no more skbs will come in. The receive queue is purged right
> after the synchronize_net() already.
>
> packet_sock_destruct() will be called afterwards, when there are no more
> refs on the socket anymore and no af_packet skbs in tx waiting for completion.
> Only then, in sk_destruct(), we'll call into packet_sock_destruct().
>
> So, eventually double purging the sk_receive_queue seems not the right
> thing to do at first look, and w/o any deeper analysis in the commit description.
>
> Could you look a bit further into the issue? Do you have a reproducer to
> trigger it?
It is Suspend Resume scenario and in this case close(sock_id) is
not called and hence packet_release is also not called.
In case of suspend, driver power down its ethernet port and release all the
sk_buff stored in RX and TX ring. driver calls dev_kfree_skb_any to release all
the sk_buff in tx ring and if last tx buff of socket is called then
packet_sock_destruct() will be invoked and will result in warning if and recevive sk_buff is
still in receive queue.
Driver calls dev_kfree_skb_any->dev_kfree_skb_irq
and it adds buffer in completion queue to free and raises softirq NET_TX_SOFTIRQ
net_tx_action->__kfree_skb->skb_release_all->skb_release_head_state->sock_wfree->
__sk_free->packet_sock_destruct
Also purging of receive queue has been taken care in other protocols.
// IP protocol
void inet_sock_destruct(struct sock *sk)
{
struct inet_sock *inet = inet_sk(sk);
__skb_queue_purge(&sk->sk_receive_queue); // Purge Receive queue
__skb_queue_purge(&sk->sk_error_queue);
....
WARN_ON(atomic_read(&sk->sk_rmem_alloc));
WARN_ON(atomic_read(&sk->sk_wmem_alloc));
}
So i think it should be done in Raw sockets also.
>> ---
>> net/packet/af_packet.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
>> index 81b4b81..bcb37ba 100644
Thanks
Vaneet Narang
next reply other threads:[~2016-01-18 10:11 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-18 10:11 Vaneet Narang [this message]
2016-01-18 11:08 ` [PATCH] af_packet: Raw socket destruction warning fix Daniel Borkmann
-- strict thread matches above, loose matches on Subject: below --
2016-02-10 12:43 Vaneet Narang
2016-02-10 14:56 ` Eric Dumazet
2016-02-05 5:23 Vaneet Narang
2016-01-21 11:40 Maninder Singh
2016-01-26 0:13 ` Daniel Borkmann
2016-01-18 6:37 Maninder Singh
2016-01-18 9:44 ` Daniel Borkmann
2016-01-18 10:29 ` Daniel Borkmann
2016-02-05 11:26 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1385051583.176751453111860930.JavaMail.weblogic@ep2mlwas01a \
--to=v.narang@samsung.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dwmw2@infradead.org \
--cc=edumazet@google.com \
--cc=eyal.birger@gmail.com \
--cc=fruggeri@aristanetworks.com \
--cc=gh007.kim@samsung.com \
--cc=hakbong5.lee@samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maninder1.s@samsung.com \
--cc=netdev@vger.kernel.org \
--cc=pankaj.m@samsung.com \
--cc=tklauser@distanz.ch \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).