From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754528AbcARJpI (ORCPT ); Mon, 18 Jan 2016 04:45:08 -0500 Received: from www62.your-server.de ([213.133.104.62]:49513 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754468AbcARJpG (ORCPT ); Mon, 18 Jan 2016 04:45:06 -0500 Message-ID: <569CB419.6050102@iogearbox.net> Date: Mon, 18 Jan 2016 10:44:57 +0100 From: Daniel Borkmann User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Maninder Singh CC: davem@davemloft.net, willemb@google.com, edumazet@google.com, eyal.birger@gmail.com, tklauser@distanz.ch, fruggeri@aristanetworks.com, dwmw2@infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, pankaj.m@samsung.com, gh007.kim@samsung.com, hakbong5.lee@samsung.com, Vaneet Narang Subject: Re: [PATCH] af_packet: Raw socket destruction warning fix References: <1453099068-39022-1-git-send-email-maninder1.s@samsung.com> In-Reply-To: <1453099068-39022-1-git-send-email-maninder1.s@samsung.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/18/2016 07:37 AM, Maninder Singh wrote: > Receieve queue is not purged when socket dectruction is called > results in kernel warning because of non zero sk_rmem_alloc. > > WARNING: at net/packet/af_packet.c:1142 packet_sock_destruct > > Backtrace: > WARN_ON(atomic_read(&sk->sk_rmem_alloc) > packet_sock_destruct > __sk_free > sock_wfree > skb_release_head_state > skb_release_all > __kfree_skb > net_tx_action > __do_softirq > run_ksoftirqd > > Signed-off-by: Vaneet Narang > Signed-off-by: Maninder Singh Thanks for the fix. While it fixes the WARN_ON(), I believe some more investigation is needed here on why it is happening: We call first into packet_release(), which removes the socket hook from the kernel (unregister_prot_hook()), later calls synchronize_net() to make sure no more skbs will come in. The receive queue is purged right after the synchronize_net() already. packet_sock_destruct() will be called afterwards, when there are no more refs on the socket anymore and no af_packet skbs in tx waiting for completion. Only then, in sk_destruct(), we'll call into packet_sock_destruct(). So, eventually double purging the sk_receive_queue seems not the right thing to do at first look, and w/o any deeper analysis in the commit description. Could you look a bit further into the issue? Do you have a reproducer to trigger it? Thanks, Daniel > --- > net/packet/af_packet.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c > index 81b4b81..bcb37ba 100644 > --- a/net/packet/af_packet.c > +++ b/net/packet/af_packet.c > @@ -1310,6 +1310,7 @@ static bool packet_rcv_has_room(struct packet_sock *po, struct sk_buff *skb) > > static void packet_sock_destruct(struct sock *sk) > { > + skb_queue_purge(&sk->sk_receive_queue); > skb_queue_purge(&sk->sk_error_queue); > > WARN_ON(atomic_read(&sk->sk_rmem_alloc)); >