* [PATCH net 1/2] mptcp: don't orphan ssk in mptcp_close()
2022-11-28 15:42 [PATCH net 0/2] mptcp: More fixes for 6.1 Matthieu Baerts
@ 2022-11-28 15:42 ` Matthieu Baerts
2022-11-28 15:42 ` [PATCH net 2/2] mptcp: fix sleep in atomic at close time Matthieu Baerts
2022-11-29 2:20 ` [PATCH net 0/2] mptcp: More fixes for 6.1 patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Matthieu Baerts @ 2022-11-28 15:42 UTC (permalink / raw)
To: Mat Martineau, Matthieu Baerts, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Davide Caratti
Cc: Menglong Dong, Biao Jiang, Mengen Sun, netdev, mptcp, linux-kernel
From: Menglong Dong <imagedong@tencent.com>
All of the subflows of a msk will be orphaned in mptcp_close(), which
means the subflows are in DEAD state. After then, DATA_FIN will be sent,
and the other side will response with a DATA_ACK for this DATA_FIN.
However, if the other side still has pending data, the data that received
on these subflows will not be passed to the msk, as they are DEAD and
subflow_data_ready() will not be called in tcp_data_ready(). Therefore,
these data can't be acked, and they will be retransmitted again and again,
until timeout.
Fix this by setting ssk->sk_socket and ssk->sk_wq to 'NULL', instead of
orphaning the subflows in __mptcp_close(), as Paolo suggested.
Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close")
Reviewed-by: Biao Jiang <benbjiang@tencent.com>
Reviewed-by: Mengen Sun <mengensun@tencent.com>
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Reviewed-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
---
net/mptcp/protocol.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index b6dc6e260334..1dbc62537259 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2354,12 +2354,7 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
goto out;
}
- /* if we are invoked by the msk cleanup code, the subflow is
- * already orphaned
- */
- if (ssk->sk_socket)
- sock_orphan(ssk);
-
+ sock_orphan(ssk);
subflow->disposable = 1;
/* if ssk hit tcp_done(), tcp_cleanup_ulp() cleared the related ops
@@ -2940,7 +2935,11 @@ bool __mptcp_close(struct sock *sk, long timeout)
if (ssk == msk->first)
subflow->fail_tout = 0;
- sock_orphan(ssk);
+ /* detach from the parent socket, but allow data_ready to
+ * push incoming data into the mptcp stack, to properly ack it
+ */
+ ssk->sk_socket = NULL;
+ ssk->sk_wq = NULL;
unlock_sock_fast(ssk, slow);
}
sock_orphan(sk);
--
2.37.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net 2/2] mptcp: fix sleep in atomic at close time
2022-11-28 15:42 [PATCH net 0/2] mptcp: More fixes for 6.1 Matthieu Baerts
2022-11-28 15:42 ` [PATCH net 1/2] mptcp: don't orphan ssk in mptcp_close() Matthieu Baerts
@ 2022-11-28 15:42 ` Matthieu Baerts
2022-11-29 2:20 ` [PATCH net 0/2] mptcp: More fixes for 6.1 patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Matthieu Baerts @ 2022-11-28 15:42 UTC (permalink / raw)
To: Mat Martineau, Matthieu Baerts, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Menglong Dong, Mengen Sun,
Jiang Biao
Cc: netdev, mptcp, linux-kernel
From: Paolo Abeni <pabeni@redhat.com>
Matt reported a splat at msk close time:
BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 155, name: packetdrill
preempt_count: 201, expected: 0
RCU nest depth: 0, expected: 0
4 locks held by packetdrill/155:
#0: ffff888001536990 (&sb->s_type->i_mutex_key#6){+.+.}-{3:3}, at: __sock_release (net/socket.c:650)
#1: ffff88800b498130 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close (net/mptcp/protocol.c:2973)
#2: ffff88800b49a130 (sk_lock-AF_INET/1){+.+.}-{0:0}, at: __mptcp_close_ssk (net/mptcp/protocol.c:2363)
#3: ffff88800b49a0b0 (slock-AF_INET){+...}-{2:2}, at: __lock_sock_fast (include/net/sock.h:1820)
Preemption disabled at:
0x0
CPU: 1 PID: 155 Comm: packetdrill Not tainted 6.1.0-rc5 #365
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
__might_resched.cold (kernel/sched/core.c:9891)
__mptcp_destroy_sock (include/linux/kernel.h:110)
__mptcp_close (net/mptcp/protocol.c:2959)
mptcp_subflow_queue_clean (include/net/sock.h:1777)
__mptcp_close_ssk (net/mptcp/protocol.c:2363)
mptcp_destroy_common (net/mptcp/protocol.c:3170)
mptcp_destroy (include/net/sock.h:1495)
__mptcp_destroy_sock (net/mptcp/protocol.c:2886)
__mptcp_close (net/mptcp/protocol.c:2959)
mptcp_close (net/mptcp/protocol.c:2974)
inet_release (net/ipv4/af_inet.c:432)
__sock_release (net/socket.c:651)
sock_close (net/socket.c:1367)
__fput (fs/file_table.c:320)
task_work_run (kernel/task_work.c:181 (discriminator 1))
exit_to_user_mode_prepare (include/linux/resume_user_mode.h:49)
syscall_exit_to_user_mode (kernel/entry/common.c:130)
do_syscall_64 (arch/x86/entry/common.c:87)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
We can't call mptcp_close under the 'fast' socket lock variant, replace
it with a sock_lock_nested() as the relevant code is already under the
listening msk socket lock protection.
Reported-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/316
Fixes: 30e51b923e43 ("mptcp: fix unreleased socket in accept queue")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
---
net/mptcp/subflow.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 02a54d59697b..2159b5f9988f 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1745,16 +1745,16 @@ void mptcp_subflow_queue_clean(struct sock *listener_ssk)
for (msk = head; msk; msk = next) {
struct sock *sk = (struct sock *)msk;
- bool slow, do_cancel_work;
+ bool do_cancel_work;
sock_hold(sk);
- slow = lock_sock_fast_nested(sk);
+ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
next = msk->dl_next;
msk->first = NULL;
msk->dl_next = NULL;
do_cancel_work = __mptcp_close(sk, 0);
- unlock_sock_fast(sk, slow);
+ release_sock(sk);
if (do_cancel_work)
mptcp_cancel_work(sk);
sock_put(sk);
--
2.37.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net 0/2] mptcp: More fixes for 6.1
2022-11-28 15:42 [PATCH net 0/2] mptcp: More fixes for 6.1 Matthieu Baerts
2022-11-28 15:42 ` [PATCH net 1/2] mptcp: don't orphan ssk in mptcp_close() Matthieu Baerts
2022-11-28 15:42 ` [PATCH net 2/2] mptcp: fix sleep in atomic at close time Matthieu Baerts
@ 2022-11-29 2:20 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-11-29 2:20 UTC (permalink / raw)
To: Matthieu Baerts
Cc: dcaratti, davem, edumazet, kuba, mathew.j.martineau, mengensun,
imagedong, pabeni, benbjiang, linux-kernel, mptcp, netdev
Hello:
This series was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 28 Nov 2022 16:42:36 +0100 you wrote:
> Patch 1 makes sure data received after a close will still be processed and acked
> as exepected. This is a regression for a commit introduced in v5.11.
>
> Patch 2 fixes a kernel deadlock found when working on validating TFO with a
> listener MPTCP socket. This is not directly linked to TFO but it is easier to
> reproduce the issue with it. This fixes a bug introduced by a commit from v6.0.
>
> [...]
Here is the summary with links:
- [net,1/2] mptcp: don't orphan ssk in mptcp_close()
https://git.kernel.org/netdev/net/c/fe94800184f2
- [net,2/2] mptcp: fix sleep in atomic at close time
https://git.kernel.org/netdev/net/c/b4f166651d03
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread