From: Cedric Le Goater <clg@fr.ibm.com>
To: "Ilpo Järvinen" <ilpo.jarvinen@helsinki.fi>
Cc: David Miller <davem@davemloft.net>,
Andrew Morton <akpm@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Netdev <netdev@vger.kernel.org>
Subject: Re: 2.6.24-rc4-mm1 - BUG in tcp_fragment
Date: Fri, 14 Dec 2007 07:52:10 +0100 [thread overview]
Message-ID: <4762281A.8000600@fr.ibm.com> (raw)
In-Reply-To: <Pine.LNX.4.64.0712140024360.12376@kivilampi-30.cs.helsinki.fi>
Ilpo Järvinen wrote:
> On Thu, 13 Dec 2007, Cedric Le Goater wrote:
>
>> I got this one while compiling on NFS.
>>
>> C.
>>
>> kernel BUG at /home/legoater/linux/2.6.24-rc4-mm1/include/net/tcp.h:1480!
>
> I'm not exactly sure what patches you have applied and which patches are
> not, with rc4-mm1 there are two patches (first one was incomplete, I
> assume you had at least that one based on your other mail) to really fix
> the issues in (__|)tcp_reset_fack_counts(...).
Yes I only have the first patch you sent on lkml on top of 2.6.24-rc4-mm1.
attached below. I didn't see the second one on lkml ?
> However, there seems to be so much breakage that I have a bit trouble to
> decide where to start... The situation seems bit scary :-).
my n/w environment seems to reproduce these issues quite easily. if you
need some testing, just ping me.
Cheers,
C.
> So, I might soon prepare a revert patch for most of the questionable
> TCP parts and ask Dave to apply it (and drop them fully during next
> rebase) unless I suddently figure something out soon which explains
> all/most of the problems, then return to drawing board. ...As it seems
> that the cumulative ACK processing problem discovered later on (having
> rather cumbersome solution with skbs only) will make part of the work
> that's currently in net-2.6.25 quite useless/duplicate effort. But thanks
> anyway for reporting these.
>
>
Subject: [PATCH] [TCP]: Fix fack_count miscountings (multiple places)
1) Fack_count is set incorrectly if the highest sent skb is
already sacked (the skb->prev won't return it because it's on
the other list already). These manifest as fackets_out counting
error later on, the second-order effects are very hard to track,
so it may fix all out-standing TCP bug reports.
2) Prev == NULL check was wrong way around
3) Last skb's fack count was incorrectly skipped while() {} loop
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
---
include/net/tcp.h | 22 ++++++++++++++++------
1 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9dbed0b..11a7e3e 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1337,10 +1337,20 @@ static inline struct sk_buff *tcp_send_head(struct sock *sk)
static inline void tcp_advance_send_head(struct sock *sk, struct sk_buff *skb)
{
struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
+ unsigned int fc = 0;
+
+ if (prev == (struct sk_buff *)&sk->sk_write_queue)
+ prev = NULL;
+ else if (!tcp_skb_adjacent(sk, prev, skb))
+ prev = NULL;
- if (prev != (struct sk_buff *)&sk->sk_write_queue)
- TCP_SKB_CB(skb)->fack_count = TCP_SKB_CB(prev)->fack_count +
- tcp_skb_pcount(prev);
+ if ((prev == NULL) && !__tcp_write_queue_empty(sk, TCP_WQ_SACKED))
+ prev = __tcp_write_queue_tail(sk, TCP_WQ_SACKED);
+
+ if (prev != NULL)
+ fc = TCP_SKB_CB(prev)->fack_count + tcp_skb_pcount(prev);
+
+ TCP_SKB_CB(skb)->fack_count = fc;
sk->sk_send_head = tcp_write_queue_next(sk, skb);
if (sk->sk_send_head == (struct sk_buff *)&sk->sk_write_queue)
@@ -1464,7 +1474,7 @@ static inline struct sk_buff *__tcp_reset_fack_counts(struct sock *sk,
{
unsigned int fc = 0;
- if (prev == NULL)
+ if (prev != NULL)
fc = TCP_SKB_CB(*prev)->fack_count + tcp_skb_pcount(*prev);
BUG_ON((*prev != NULL) && !tcp_skb_adjacent(sk, *prev, skb));
@@ -1521,7 +1531,7 @@ static inline void tcp_reset_fack_counts(struct sock *sk, struct sk_buff *inskb)
skb[otherq] = prev->next;
}
- while (skb[queue] != __tcp_write_queue_tail(sk, queue)) {
+ do {
/* Lazy find for the other queue */
if (skb[queue] == NULL) {
skb[queue] = tcp_write_queue_find(sk, TCP_SKB_CB(prev)->seq,
@@ -1535,7 +1545,7 @@ static inline void tcp_reset_fack_counts(struct sock *sk, struct sk_buff *inskb)
break;
queue ^= TCP_WQ_SACKED;
- }
+ } while (skb[queue] != __tcp_write_queue_tail(sk, queue));
}
static inline void __tcp_insert_write_queue_after(struct sk_buff *skb,
-- 1.5.0.6
next prev parent reply other threads:[~2007-12-14 6:52 UTC|newest]
Thread overview: 112+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-12-05 5:17 2.6.24-rc4-mm1 Andrew Morton
2007-12-05 9:15 ` 2.6.24-rc4-mm1: kobj changes fallout on powerpc Olof Johansson
2007-12-05 13:11 ` Kamalesh Babulal
2007-12-05 15:46 ` Greg KH
2007-12-05 14:12 ` 2.6.24-rc4-mm1 kobject changes broken with hvcs driver " Kamalesh Babulal
2007-12-05 15:47 ` Greg KH
2007-12-06 18:19 ` Balbir Singh
2007-12-06 18:50 ` Greg KH
2007-12-06 18:49 ` Kamalesh Babulal
2007-12-06 18:58 ` Balbir Singh
2007-12-06 19:21 ` Badari Pulavarty
2007-12-07 1:29 ` Balbir Singh
2007-12-06 20:31 ` Greg KH
2007-12-06 23:54 ` Badari Pulavarty
2007-12-07 0:32 ` Greg KH
2007-12-07 3:02 ` Kamalesh Babulal
2007-12-07 5:14 ` Greg KH
2007-12-07 22:01 ` Balbir Singh
2007-12-05 23:41 ` 2.6.24-rc4-mm1: hostbyte=0x01 driverbyte=0x00 (now bisected) Alexey Dobriyan
2007-12-06 7:52 ` Hannes Reinecke
2007-12-06 12:08 ` Jens Axboe
2007-12-06 19:19 ` Alexey Dobriyan
2007-12-06 3:15 ` 2.6.24-rc4-mm1 Kernel build fails on S390x Kamalesh Babulal
2007-12-06 7:19 ` Andrew Morton
2007-12-06 6:59 ` 2.6.24-rc4-mm1 Reuben Farrelly
2007-12-06 7:09 ` 2.6.24-rc4-mm1 David Miller
2007-12-07 13:16 ` 2.6.24-rc4-mm1 Ilpo Järvinen
2007-12-12 17:57 ` 2.6.24-rc4-mm1 Cedric Le Goater
2007-12-06 7:35 ` 2.6.24-rc4-mm1 Andrew Morton
2007-12-10 12:24 ` 2.6.24-rc4-mm1 Ilpo Järvinen
2007-12-10 20:05 ` 2.6.24-rc4-mm1 Ilpo Järvinen
2007-12-12 19:21 ` 2.6.24-rc4-mm1 Cedric Le Goater
2007-12-13 17:38 ` tcp_sacktag_one() WARNING (was Re: 2.6.24-rc4-mm1) Cedric Le Goater
2007-12-06 11:49 ` 2.6.24-rc4-mm1 Valdis.Kletnieks
2007-12-06 12:04 ` 2.6.24-rc4-mm1 Andrew Morton
2007-12-06 19:18 ` 2.6.24-rc4-mm1 Valdis.Kletnieks
2007-12-06 19:38 ` 2.6.24-rc4-mm1 Greg KH
2007-12-06 20:04 ` 2.6.24-rc4-mm1 Valdis.Kletnieks
2007-12-06 22:04 ` [dm-devel] 2.6.24-rc4-mm1 Kay Sievers
2007-12-06 22:12 ` Alasdair G Kergon
2007-12-06 23:12 ` Valdis.Kletnieks
2007-12-06 23:24 ` Kay Sievers
2007-12-07 18:20 ` Valdis.Kletnieks
2007-12-07 18:44 ` Kay Sievers
2007-12-07 20:28 ` Valdis.Kletnieks
2007-12-07 20:49 ` Kay Sievers
2007-12-06 22:28 ` 2.6.24-rc4-mm1: VDSOSYM build error Laurent Riffard
2007-12-06 22:37 ` Andrew Morton
2007-12-06 23:28 ` Miles Lane
2007-12-06 23:34 ` Andrew Morton
2007-12-06 23:47 ` Miles Lane
2007-12-07 10:36 ` Ingo Molnar
2007-12-07 1:14 ` [PATCH x86/mm] x86 vDSO: canonicalize sysenter .eh_frame Roland McGrath
2007-12-07 1:27 ` Harvey Harrison
2007-12-07 3:27 ` Miles Lane
2007-12-07 9:44 ` Ingo Molnar
2007-12-07 2:12 ` 2.6.24-rc4-mm1 Dave Young
2007-12-07 22:22 ` 2.6.24-rc4-mm1 Luis R. Rodriguez
2007-12-10 1:07 ` 2.6.24-rc4-mm1 Dave Young
2007-12-09 17:55 ` 2.6.24-rc4-mm1 Nick Kossifidis
[not found] ` <E1J0Yfy-0001V7-Rr@localhost>
2007-12-07 8:35 ` [PATCH BUGFIX] hid: the `bit' in hidinput_mapping_quirks() is an out parameter Fengguang Wu
2007-12-10 10:03 ` Jiri Kosina
2007-12-07 14:34 ` broken suspend (sched related) [Was: 2.6.24-rc4-mm1] Jiri Slaby
2007-12-07 15:11 ` Ingo Molnar
2007-12-07 17:51 ` Ingo Molnar
2007-12-08 8:10 ` Jiri Slaby
2007-12-08 8:39 ` Ingo Molnar
2007-12-08 9:23 ` Jiri Slaby
2007-12-08 15:24 ` Ingo Molnar
2007-12-08 17:34 ` Jiri Slaby
2007-12-08 17:43 ` Jiri Slaby
2007-12-09 8:06 ` Ingo Molnar
2007-12-08 23:12 ` Jiri Slaby
2007-12-09 7:46 ` Ingo Molnar
2007-12-09 9:09 ` Jiri Slaby
2007-12-10 8:19 ` Gautham R Shenoy
2007-12-10 8:55 ` Jiri Slaby
2007-12-10 9:10 ` Ingo Molnar
2007-12-10 10:15 ` Gautham R Shenoy
2007-12-10 10:21 ` Ingo Molnar
2007-12-10 11:08 ` Gautham R Shenoy
2007-12-10 11:28 ` Ingo Molnar
2007-12-10 11:49 ` Gautham R Shenoy
2007-12-10 9:29 ` Ingo Molnar
2007-12-07 18:20 ` [PATCH] md: balance braces in raid5 debug code Mariusz Kozlowski
2007-12-08 0:04 ` 2.6.24-rc4-mm1: undefined reference to `compat_sys_timerfd' on sparc64 Mariusz Kozlowski
2007-12-08 0:08 ` Andrew Morton
2007-12-08 9:17 ` Mariusz Kozlowski
2007-12-11 10:15 ` David Miller
2007-12-08 18:20 ` 2.6.24-rc4-mm1: some issues " Mariusz Kozlowski
2007-12-08 18:22 ` Andrew Morton
2007-12-09 8:45 ` David Miller
2007-12-09 9:03 ` Andrew Morton
2007-12-10 14:48 ` 2.6.24-rc4-mm1 Reuben Farrelly
2007-12-10 21:11 ` 2.6.24-rc4-mm1 Andrew Morton
2007-12-11 14:12 ` 2.6.24-rc4-mm1 Reuben Farrelly
2007-12-11 16:20 ` 2.6.24-rc4-mm1 Martin Bligh
2007-12-11 16:59 ` 2.6.24-rc4-mm1 Randy Dunlap
2007-12-11 17:50 ` 2.6.24-rc4-mm1 Martin Bligh
[not found] ` <33307c790712110813h23def95dvd068b7226e9fcd36@mail.gmail.com>
2007-12-11 20:37 ` 2.6.24-rc4-mm1 Andrew Morton
2007-12-11 21:20 ` 2.6.24-rc4-mm1 Ingo Molnar
2007-12-11 21:26 ` 2.6.24-rc4-mm1 Kok, Auke
2007-12-11 21:59 ` 2.6.24-rc4-mm1 Kok, Auke
2007-12-11 22:10 ` 2.6.24-rc4-mm1 Andrew Morton
2007-12-11 22:17 ` 2.6.24-rc4-mm1 Kok, Auke
2007-12-11 23:15 ` 2.6.24-rc4-mm1 Randy Dunlap
2007-12-12 4:16 ` 2.6.24-rc4-mm1 Rik van Riel
2007-12-13 17:45 ` 2.6.24-rc4-mm1 - BUG in tcp_fragment Cedric Le Goater
2007-12-13 23:00 ` Ilpo Järvinen
2007-12-14 6:52 ` Cedric Le Goater [this message]
2007-12-14 20:14 ` [PATCH net-2.6.25] Revert recent TCP work Ilpo Järvinen
2007-12-16 22:21 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4762281A.8000600@fr.ibm.com \
--to=clg@fr.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=ilpo.jarvinen@helsinki.fi \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).