| From e3e08404e20f28077ce155e397c9ed9e7a824b97 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 30 May 2022 14:37:13 -0700 |
| Subject: tcp: tcp_rtx_synack() can be called from process context |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| [ Upstream commit 0a375c822497ed6ad6b5da0792a12a6f1af10c0b ] |
| |
| Laurent reported the enclosed report [1] |
| |
| This bug triggers with following coditions: |
| |
| 0) Kernel built with CONFIG_DEBUG_PREEMPT=y |
| |
| 1) A new passive FastOpen TCP socket is created. |
| This FO socket waits for an ACK coming from client to be a complete |
| ESTABLISHED one. |
| 2) A socket operation on this socket goes through lock_sock() |
| release_sock() dance. |
| 3) While the socket is owned by the user in step 2), |
| a retransmit of the SYN is received and stored in socket backlog. |
| 4) At release_sock() time, the socket backlog is processed while |
| in process context. |
| 5) A SYNACK packet is cooked in response of the SYN retransmit. |
| 6) -> tcp_rtx_synack() is called in process context. |
| |
| Before blamed commit, tcp_rtx_synack() was always called from BH handler, |
| from a timer handler. |
| |
| Fix this by using TCP_INC_STATS() & NET_INC_STATS() |
| which do not assume caller is in non preemptible context. |
| |
| [1] |
| BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 |
| caller is tcp_rtx_synack.part.0+0x36/0xc0 |
| CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 |
| Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 |
| Call Trace: |
| <TASK> |
| dump_stack_lvl+0x48/0x5e |
| check_preemption_disabled+0xde/0xe0 |
| tcp_rtx_synack.part.0+0x36/0xc0 |
| tcp_rtx_synack+0x8d/0xa0 |
| ? kmem_cache_alloc+0x2e0/0x3e0 |
| ? apparmor_file_alloc_security+0x3b/0x1f0 |
| inet_rtx_syn_ack+0x16/0x30 |
| tcp_check_req+0x367/0x610 |
| tcp_rcv_state_process+0x91/0xf60 |
| ? get_nohz_timer_target+0x18/0x1a0 |
| ? lock_timer_base+0x61/0x80 |
| ? preempt_count_add+0x68/0xa0 |
| tcp_v4_do_rcv+0xbd/0x270 |
| __release_sock+0x6d/0xb0 |
| release_sock+0x2b/0x90 |
| sock_setsockopt+0x138/0x1140 |
| ? __sys_getsockname+0x7e/0xc0 |
| ? aa_sk_perm+0x3e/0x1a0 |
| __sys_setsockopt+0x198/0x1e0 |
| __x64_sys_setsockopt+0x21/0x30 |
| do_syscall_64+0x38/0xc0 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: Laurent Fasnacht <laurent.fasnacht@proton.ch> |
| Acked-by: Neal Cardwell <ncardwell@google.com> |
| Link: https://lore.kernel.org/r/20220530213713.601888-1-eric.dumazet@gmail.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/ipv4/tcp_output.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c |
| index 95b0f486cb10..e0009cd69da7 100644 |
| --- a/net/ipv4/tcp_output.c |
| +++ b/net/ipv4/tcp_output.c |
| @@ -3709,8 +3709,8 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req) |
| tcp_rsk(req)->txhash = net_tx_rndhash(); |
| res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL); |
| if (!res) { |
| - __TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS); |
| - __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS); |
| + TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS); |
| + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS); |
| if (unlikely(tcp_passive_fastopen(sk))) |
| tcp_sk(sk)->total_retrans++; |
| } |
| -- |
| 2.35.1 |
| |