41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
|
From 0a9648f1293966c838dc570da73c15a76f4c89d6 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Eric Dumazet <edumazet@google.com>
|
||
|
|
Date: Wed, 21 Dec 2016 05:42:43 -0800
|
||
|
|
Subject: [PATCH 09/10] tcp: add a missing barrier in tcp_tasklet_func()
|
||
|
|
|
||
|
|
Madalin reported crashes happening in tcp_tasklet_func() on powerpc64
|
||
|
|
|
||
|
|
Before TSQ_QUEUED bit is cleared, we must ensure the changes done
|
||
|
|
by list_del(&tp->tsq_node); are committed to memory, otherwise
|
||
|
|
corruption might happen, as an other cpu could catch TSQ_QUEUED
|
||
|
|
clearance too soon.
|
||
|
|
|
||
|
|
We can notice that old kernels were immune to this bug, because
|
||
|
|
TSQ_QUEUED was cleared after a bh_lock_sock(sk)/bh_unlock_sock(sk)
|
||
|
|
section, but they could have missed a kick to write additional bytes,
|
||
|
|
when NIC interrupts for a given flow are spread to multiple cpus.
|
||
|
|
|
||
|
|
Affected TCP flows would need an incoming ACK or RTO timer to add more
|
||
|
|
packets to the pipe. So overall situation should be better now.
|
||
|
|
|
||
|
|
Fixes: b223feb9de2a ("tcp: tsq: add shortcut in tcp_tasklet_func()")
|
||
|
|
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||
|
|
Reported-by: Madalin Bucur <madalin.bucur@nxp.com>
|
||
|
|
Tested-by: Madalin Bucur <madalin.bucur@nxp.com>
|
||
|
|
Tested-by: Xing Lei <xing.lei@nxp.com>
|
||
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||
|
|
---
|
||
|
|
net/ipv4/tcp_output.c | 1 +
|
||
|
|
1 file changed, 1 insertion(+)
|
||
|
|
|
||
|
|
--- a/net/ipv4/tcp_output.c
|
||
|
|
+++ b/net/ipv4/tcp_output.c
|
||
|
|
@@ -769,6 +769,7 @@ static void tcp_tasklet_func(unsigned lo
|
||
|
|
list_del(&tp->tsq_node);
|
||
|
|
|
||
|
|
sk = (struct sock *)tp;
|
||
|
|
+ smp_mb__before_atomic();
|
||
|
|
clear_bit(TSQ_QUEUED, &sk->sk_tsq_flags);
|
||
|
|
|
||
|
|
if (!sk->sk_lock.owned &&
|