All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Miller <davem@davemloft.net>
To: kaiwen.xu@hulu.com
Cc: netdev@vger.kernel.org
Subject: Re: [PATCH] [PATCH net] net: Do not hold the reference for the same sk_rx_dst.
Date: Thu, 16 Mar 2017 11:16:47 -0700 (PDT)	[thread overview]
Message-ID: <20170316.111647.1545474188593011995.davem@davemloft.net> (raw)
In-Reply-To: <1489651711-4105-1-git-send-email-kaiwen.xu@hulu.com>

From: Kevin Xu <kaiwen.xu@hulu.com>
Date: Thu, 16 Mar 2017 01:08:30 -0700

> In some rare cases, inet_sk_rx_dst_set() may be called multiple times
> on the same dst, causing reference count leakage. Eventually, it
> prevents net_device to be destroyed. The bug then manifested as
> 
> unregister_netdevice: waiting for lo to become free. Usage count = 1
> 
> in the kernel log, preventing new network namespace creation.
> 
> The patch works around the issue by checking whether the socket already
> has the same dst set.
> 
> Signed-off-by: Kevin Xu <kaiwen.xu@hulu.com>

You need to prevent this parallel execution of this function or use
atomic compare-and-exchange to set the rx_dst in order to prevent
the double refcounting.

This patch by itself is even worse than a workaround, because depending
upon how the compiler reloads values from memory, the problem can still
occur.

  parent reply	other threads:[~2017-03-16 18:16 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-16  8:08 [PATCH] [PATCH net] net: Do not hold the reference for the same sk_rx_dst Kevin Xu
2017-03-16 10:01 ` Jakub Sitnicki
2017-03-16 10:12   ` Kevin Xu
2017-03-16 10:45     ` Jakub Sitnicki
2017-03-16 18:18       ` Kaiwen Xu
2017-03-16 18:42         ` Cong Wang
2017-03-16 18:16 ` David Miller [this message]
2017-03-19  1:48   ` [PATCH net v2] " Kevin Xu
2017-03-19  3:49     ` Cong Wang
2017-03-19  4:03       ` Kaiwen Xu
2017-03-20  4:09         ` Cong Wang
2017-03-20 21:23           ` Kaiwen Xu
2017-03-16 21:33 ` [PATCH] [PATCH net] " Eric Dumazet
2017-03-16 23:13   ` Cong Wang
2017-03-16 23:29     ` Eric Dumazet

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170316.111647.1545474188593011995.davem@davemloft.net \
    --to=davem@davemloft.net \
    --cc=kaiwen.xu@hulu.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.