[PATCH net-next] tcp: drop dst in tcp_add_backlog()

[PATCH net-next] tcp: drop dst in tcp_add_backlog()

[Eric Dumazet]

Under stress, softirq rx handler often hits a socket owned by the user,
and has to queue the packet into socket backlog.

When this happens, skb dst refcount is taken before we escape rcu
protected region. This is done from __sk_add_backlog() calling
skb_dst_force().

Consumer will have to perform the opposite costly operation.

AFAIK nothing in tcp stack requests the dst after skb was stored
in the backlog. If this was the case, we would have had failures
already since skb_dst_force() can end up clearing skb dst anyway.

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv4/tcp_ipv4.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 0952d4b772e7aa3cfb936596aa586dbd2dd6efde..795605a2327504b8a025405826e7e0ca8dc8501d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1634,6 +1634,8 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
 	 */
 	skb_condense(skb);
 
+	skb_dst_drop(skb);
+
 	if (unlikely(sk_add_backlog(sk, skb, limit))) {
 		bh_unlock_sock(sk);
 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPBACKLOGDROP);
-- 
2.19.1.1215.g8438c0b245-goog

Re: [PATCH net-next] tcp: drop dst in tcp_add_backlog()

[David Miller]

From: Eric Dumazet <edumazet@google.com>
Date: Mon, 19 Nov 2018 17:45:55 -0800

> Under stress, softirq rx handler often hits a socket owned by the user,
> and has to queue the packet into socket backlog.
> 
> When this happens, skb dst refcount is taken before we escape rcu
> protected region. This is done from __sk_add_backlog() calling
> skb_dst_force().
> 
> Consumer will have to perform the opposite costly operation.
> 
> AFAIK nothing in tcp stack requests the dst after skb was stored
> in the backlog. If this was the case, we would have had failures
> already since skb_dst_force() can end up clearing skb dst anyway.
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Hmmm, it seems to be used by connection completion code to setup the
socket cached rx dst, right?

For example tcp_finish_connect() --> icsk->icsk_af_ops->sk_rx_dst_set(sk, skb)

Re: [PATCH net-next] tcp: drop dst in tcp_add_backlog()

[Eric Dumazet]

On Tue, Nov 20, 2018 at 10:01 AM David Miller <davem@davemloft.net> wrote:
>
> From: Eric Dumazet <edumazet@google.com>
> Date: Mon, 19 Nov 2018 17:45:55 -0800
>
> > Under stress, softirq rx handler often hits a socket owned by the user,
> > and has to queue the packet into socket backlog.
> >
> > When this happens, skb dst refcount is taken before we escape rcu
> > protected region. This is done from __sk_add_backlog() calling
> > skb_dst_force().
> >
> > Consumer will have to perform the opposite costly operation.
> >
> > AFAIK nothing in tcp stack requests the dst after skb was stored
> > in the backlog. If this was the case, we would have had failures
> > already since skb_dst_force() can end up clearing skb dst anyway.
> >
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
>
> Hmmm, it seems to be used by connection completion code to setup the
> socket cached rx dst, right?
>
> For example tcp_finish_connect() --> icsk->icsk_af_ops->sk_rx_dst_set(sk, skb)

We already cope with skb->dst being NULL there I believe.

For reference look at

commit 5037e9ef9454917b047f9f3a19b4dd179fbf7cd4    net: fix IP early demux races

Re: [PATCH net-next] tcp: drop dst in tcp_add_backlog()

[David Miller]

From: Eric Dumazet <edumazet@google.com>
Date: Tue, 20 Nov 2018 10:08:12 -0800

> On Tue, Nov 20, 2018 at 10:01 AM David Miller <davem@davemloft.net> wrote:
>>
>> From: Eric Dumazet <edumazet@google.com>
>> Date: Mon, 19 Nov 2018 17:45:55 -0800
>>
>> > Under stress, softirq rx handler often hits a socket owned by the user,
>> > and has to queue the packet into socket backlog.
>> >
>> > When this happens, skb dst refcount is taken before we escape rcu
>> > protected region. This is done from __sk_add_backlog() calling
>> > skb_dst_force().
>> >
>> > Consumer will have to perform the opposite costly operation.
>> >
>> > AFAIK nothing in tcp stack requests the dst after skb was stored
>> > in the backlog. If this was the case, we would have had failures
>> > already since skb_dst_force() can end up clearing skb dst anyway.
>> >
>> > Signed-off-by: Eric Dumazet <edumazet@google.com>
>>
>> Hmmm, it seems to be used by connection completion code to setup the
>> socket cached rx dst, right?
>>
>> For example tcp_finish_connect() --> icsk->icsk_af_ops->sk_rx_dst_set(sk, skb)
> 
> We already cope with skb->dst being NULL there I believe.
> 
> For reference look at
> 
> commit 5037e9ef9454917b047f9f3a19b4dd179fbf7cd4    net: fix IP early demux races

Well, I'm sure we "handle" it.  But I was more asking about the performance
tradeoff, which probably is on the side of your change but I wanted to
just be sure.

Re: [PATCH net-next] tcp: drop dst in tcp_add_backlog()

[Eric Dumazet]

On Tue, Nov 20, 2018 at 10:16 AM David Miller <davem@davemloft.net> wrote:
>
> From: Eric Dumazet <edumazet@google.com>
> Date: Tue, 20 Nov 2018 10:08:12 -0800
>
> > On Tue, Nov 20, 2018 at 10:01 AM David Miller <davem@davemloft.net> wrote:
> >>
> >> From: Eric Dumazet <edumazet@google.com>
> >> Date: Mon, 19 Nov 2018 17:45:55 -0800
> >>
> >> > Under stress, softirq rx handler often hits a socket owned by the user,
> >> > and has to queue the packet into socket backlog.
> >> >
> >> > When this happens, skb dst refcount is taken before we escape rcu
> >> > protected region. This is done from __sk_add_backlog() calling
> >> > skb_dst_force().
> >> >
> >> > Consumer will have to perform the opposite costly operation.
> >> >
> >> > AFAIK nothing in tcp stack requests the dst after skb was stored
> >> > in the backlog. If this was the case, we would have had failures
> >> > already since skb_dst_force() can end up clearing skb dst anyway.
> >> >
> >> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> >>
> >> Hmmm, it seems to be used by connection completion code to setup the
> >> socket cached rx dst, right?
> >>
> >> For example tcp_finish_connect() --> icsk->icsk_af_ops->sk_rx_dst_set(sk, skb)
> >
> > We already cope with skb->dst being NULL there I believe.
> >
> > For reference look at
> >
> > commit 5037e9ef9454917b047f9f3a19b4dd179fbf7cd4    net: fix IP early demux races
>
> Well, I'm sure we "handle" it.  But I was more asking about the performance
> tradeoff, which probably is on the side of your change but I wanted to
> just be sure.

Ah sorry for misunderstanding.
Yes, that should be fine, backlog is not generally used at the
beginning of a flow.

I am working on adding coalescing support to tcp_add_backlog() to balance
time spent in softirq and time spent from process context, hoping to reduce
probability of having user threads trapped for a while in __release_sock()

Re: [PATCH net-next] tcp: drop dst in tcp_add_backlog()

[David Miller]

From: Eric Dumazet <edumazet@google.com>
Date: Tue, 20 Nov 2018 10:21:22 -0800

> On Tue, Nov 20, 2018 at 10:16 AM David Miller <davem@davemloft.net> wrote:
>>
>> Well, I'm sure we "handle" it.  But I was more asking about the performance
>> tradeoff, which probably is on the side of your change but I wanted to
>> just be sure.
> 
> Ah sorry for misunderstanding.
> Yes, that should be fine, backlog is not generally used at the
> beginning of a flow.
> 
> I am working on adding coalescing support to tcp_add_backlog() to balance
> time spent in softirq and time spent from process context, hoping to reduce
> probability of having user threads trapped for a while in __release_sock()

Ok, meanwhile I applied the patch under discussion.

Thanks.