From: fengchunguo <[email protected]>
This patch avoids fastopen_rsk not be cleared every times, then occur
the below BUG_ON:
tcp_v4_destroy_sock
->BUG_ON(tp->fastopen_rsk);
When playback some videos from netwrok,used tcp_disconnect continually.
Call trace:
kfree+0x210/0x250
tcp_v4_destroy_sock+0xb8/0x1b0
tcp_v6_destroy_sock+0x20/0x34
inet_csk_destroy_sock+0x58/0x114
tcp_done+0x144/0x148
tcp_rcv_state_process+0x5d4/0xe3c
tcp_v4_do_rcv+0x74/0x240
tcp_v4_rcv+0xaac/0xba0
ip_local_deliver_finish+0xe8/0x25c
ip_local_deliver+0x60/0x118
ip_rcv+0x70/0x108
__netif_receive_skb_core+0x6f8/0xb80
process_backlog+0xe4/0x1f4
napi_poll+0x94/0x1ec
net_rx_action+0xe4/0x224
__do_softirq+0x16c/0x3bc
do_softirq.part.15+0x70/0x74
do_softirq+0x24/0x2c
netif_rx_ni+0x108/0x138
dhd_rxf_thread+0x134/0x1e4
kthread+0x114/0x140
ret_from_fork+0x10/0x18
Signed-off-by: fengchunguo <[email protected]>
---
net/ipv4/tcp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 61082065b26a..f5c354c0b24c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2655,6 +2655,7 @@ int tcp_disconnect(struct sock *sk, int flags)
/* Clean up fastopen related fields */
tcp_free_fastopen_req(tp);
inet->defer_connect = 0;
+ tp->fastopen_rsk = 0;
WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
--
2.22.0
On Fri, Sep 6, 2019 at 11:34 AM chunguo feng <[email protected]> wrote:
>
> From: fengchunguo <[email protected]>
>
> This patch avoids fastopen_rsk not be cleared every times, then occur
> the below BUG_ON:
> tcp_v4_destroy_sock
> ->BUG_ON(tp->fastopen_rsk);
>
> When playback some videos from netwrok,used tcp_disconnect continually.
Wow, tcp_disconnect() being used by something else than syzkaller !
> kthread+0x114/0x140
> ret_from_fork+0x10/0x18
>
> Signed-off-by: fengchunguo <[email protected]>
> ---
> net/ipv4/tcp.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 61082065b26a..f5c354c0b24c 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -2655,6 +2655,7 @@ int tcp_disconnect(struct sock *sk, int flags)
> /* Clean up fastopen related fields */
> tcp_free_fastopen_req(tp);
> inet->defer_connect = 0;
> + tp->fastopen_rsk = 0;
>
> WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
>
This seems suspicious to me.
Are we leaking a block of memory after your patch ?
If the block of memory has been freed, maybe clear the pointer at the
place the free happened ?
I am traveling to Lisbon for LPC, maybe Yuchung or Neal can take a look.
From: chunguo feng <[email protected]>
Date: Fri, 6 Sep 2019 17:34:29 +0800
> From: fengchunguo <[email protected]>
>
> This patch avoids fastopen_rsk not be cleared every times, then occur
> the below BUG_ON:
> tcp_v4_destroy_sock
> ->BUG_ON(tp->fastopen_rsk);
>
> When playback some videos from netwrok,used tcp_disconnect continually.
...
> Signed-off-by: fengchunguo <[email protected]>
This still needs review.