Eric Dumazet c3f9b01849 tcp: tcp_release_cb() should release socket ownership ... Lars Persson reported following deadlock : -000 |M:0x0:0x802B6AF8(asm) <-- arch_spin_lock -001 |tcp_v4_rcv(skb = 0x8BD527A0) <-- sk = 0x8BE6B2A0 -002 |ip_local_deliver_finish(skb = 0x8BD527A0) -003 |__netif_receive_skb_core(skb = 0x8BD527A0, ?) -004 |netif_receive_skb(skb = 0x8BD527A0) -005 |elk_poll(napi = 0x8C770500, budget = 64) -006 |net_rx_action(?) -007 |__do_softirq() -008 |do_softirq() -009 |local_bh_enable() -010 |tcp_rcv_established(sk = 0x8BE6B2A0, skb = 0x87D3A9E0, th = 0x814EBE14, ?) -011 |tcp_v4_do_rcv(sk = 0x8BE6B2A0, skb = 0x87D3A9E0) -012 |tcp_delack_timer_handler(sk = 0x8BE6B2A0) -013 |tcp_release_cb(sk = 0x8BE6B2A0) -014 |release_sock(sk = 0x8BE6B2A0) -015 |tcp_sendmsg(?, sk = 0x8BE6B2A0, ?, ?) -016 |sock_sendmsg(sock = 0x8518C4C0, msg = 0x87D8DAA8, size = 4096) -017 |kernel_sendmsg(?, ?, ?, ?, size = 4096) -018 |smb_send_kvec() -019 |smb_send_rqst(server = 0x87C4D400, rqst = 0x87D8DBA0) -020 |cifs_call_async() -021 |cifs_async_writev(wdata = 0x87FD6580) -022 |cifs_writepages(mapping = 0x852096E4, wbc = 0x87D8DC88) -023 |__writeback_single_inode(inode = 0x852095D0, wbc = 0x87D8DC88) -024 |writeback_sb_inodes(sb = 0x87D6D800, wb = 0x87E4A9C0, work = 0x87D8DD88) -025 |__writeback_inodes_wb(wb = 0x87E4A9C0, work = 0x87D8DD88) -026 |wb_writeback(wb = 0x87E4A9C0, work = 0x87D8DD88) -027 |wb_do_writeback(wb = 0x87E4A9C0, force_wait = 0) -028 |bdi_writeback_workfn(work = 0x87E4A9CC) -029 |process_one_work(worker = 0x8B045880, work = 0x87E4A9CC) -030 |worker_thread(__worker = 0x8B045880) -031 |kthread(_create = 0x87CADD90) -032 |ret_from_kernel_thread(asm) Bug occurs because __tcp_checksum_complete_user() enables BH, assuming it is running from softirq context. Lars trace involved a NIC without RX checksum support but other points are problematic as well, like the prequeue stuff. Problem is triggered by a timer, that found socket being owned by user. tcp_release_cb() should call tcp_write_timer_handler() or tcp_delack_timer_handler() in the appropriate context : BH disabled and socket lock held, but 'owned' field cleared, as if they were running from timer handlers. Fixes: 6f458dfb40 ("tcp: improve latencies of timer triggered events") Reported-by: Lars Persson <lars.persson@axis.com> Tested-by: Lars Persson <lars.persson@axis.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-03-11 16:45:59 -04:00
..
datagram.c	net, datagram: fix the incorrect comment in zerocopy_sg_from_iovec()	2013-10-29 00:19:04 -04:00
dev_addr_lists.c	net: Correctly sync addresses from multiple sources to single device	2014-01-23 13:06:34 -08:00
dev_ioctl.c	net_tstamp: Add SIOCGHWTSTAMP ioctl to match SIOCSHWTSTAMP	2013-11-19 19:07:21 +00:00
dev.c	net: core: introduce netif_skb_dev_features	2014-02-13 17:17:02 -05:00
drop_monitor.c	net: drop_monitor: fix the value of maxattr	2013-12-09 21:10:38 -05:00
dst.c	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
ethtool.c	net: Add layer 2 hardware acceleration operations for macvlan devices	2013-11-07 19:11:41 -05:00
fib_rules.c	net: fix 'ip rule' iif/oif device rename	2014-02-09 19:02:52 -08:00
filter.c	bpf: do not use reciprocal divide	2014-01-15 17:02:08 -08:00
flow_dissector.c	netdevice: move netdev_cap_txqueue for shared usage to header	2014-02-17 00:36:34 -05:00
flow.c	net: delete __cpuinit usage from all net files	2013-07-14 19:36:58 -04:00
gen_estimator.c	net_sched: add 64bit rate estimators	2013-06-11 02:51:03 -07:00
gen_stats.c	net_sched: add 64bit rate estimators	2013-06-11 02:51:03 -07:00
iovec.c	net: rework recvmsg handler msg_name and msg_namelen logic	2013-11-20 21:52:30 -05:00
link_watch.c	net: make all team port device link events urgent	2013-06-13 02:31:41 -07:00
Makefile	net: netprio: rename config to be more consistent with cgroup configs	2014-01-03 23:41:42 +01:00
neighbour.c	neigh: recompute reachabletime before returning from neigh_periodic_work()	2014-02-27 18:21:17 -05:00
net_namespace.c	userns: Kill nsown_capable it makes the wrong thing easy	2013-08-30 23:44:11 -07:00
net-procfs.c	rps: selective flow shedding during softnet overflow	2013-05-20 13:48:04 -07:00
net-sysfs.c	net: fix "queues" uevent between network namespaces	2014-01-19 20:02:02 -08:00
net-sysfs.h	net: netdev_kobject_init: annotate with __init	2014-01-05 20:27:54 -05:00
net-traces.c
netclassid_cgroup.c	net: net_cls: move cgroupfs classid handling into core	2014-01-03 23:41:41 +01:00
netevent.c
netpoll.c	netpoll: fix netconsole IPv6 setup	2014-02-06 21:28:06 -08:00
netprio_cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
pktgen.c	pktgen: Use ether_addr_copy	2014-01-21 18:13:05 -08:00
request_sock.c	tcp: fix a panic on UP machines in reqsk_fastopen_remove	2013-01-14 18:10:05 -05:00
rtnetlink.c	net: correct error path in rtnl_newlink()	2014-02-13 17:08:29 -05:00
scm.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2013-09-07 14:35:32 -07:00
secure_seq.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-10-23 16:49:34 -04:00
skbuff.c	skbuff: skb_segment: orphan frags before copying	2014-03-11 16:26:38 -04:00
sock_diag.c	sock_diag: fix filter code sent to userspace	2013-06-10 22:23:32 -07:00
sock.c	tcp: tcp_release_cb() should release socket ownership	2014-03-11 16:45:59 -04:00
stream.c	net: replace macros net_random and net_srandom with direct calls to prandom	2014-01-14 15:15:25 -08:00
sysctl_net_core.c	rps: NUMA flow limit allocations	2013-12-19 19:00:07 -05:00
timestamping.c
user_dma.c
utils.c	net: make net_get_random_once irq safe	2013-10-25 19:03:39 -04:00