From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FC72C31E5C for ; Mon, 17 Jun 2019 22:59:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 49B4A2084A for ; Mon, 17 Jun 2019 22:59:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728994AbfFQW7h (ORCPT ); Mon, 17 Jun 2019 18:59:37 -0400 Received: from mga18.intel.com ([134.134.136.126]:10995 "EHLO mga18.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728478AbfFQW6w (ORCPT ); Mon, 17 Jun 2019 18:58:52 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Jun 2019 15:58:50 -0700 X-ExtLoop1: 1 Received: from mjmartin-nuc01.amr.corp.intel.com (HELO mjmartin-nuc01.sea.intel.com) ([10.241.98.42]) by orsmga002.jf.intel.com with ESMTP; 17 Jun 2019 15:58:50 -0700 From: Mat Martineau To: edumazet@google.com, netdev@vger.kernel.org Cc: Paolo Abeni , cpaasch@apple.com, fw@strlen.de, peter.krystad@linux.intel.com, dcaratti@redhat.com, matthieu.baerts@tessares.net Subject: [RFC PATCH net-next 14/33] tcp: clean ext on tx recycle Date: Mon, 17 Jun 2019 15:57:49 -0700 Message-Id: <20190617225808.665-15-mathew.j.martineau@linux.intel.com> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190617225808.665-1-mathew.j.martineau@linux.intel.com> References: <20190617225808.665-1-mathew.j.martineau@linux.intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Paolo Abeni Otherwise we will find stray/unexpected/old extensions value on next iteration. On tcp_write_xmit() we can end-up splitting an already queued skb in two parts, via tso_fragment(). The newly created skb can be allocated via the tx cache and the mptcp stack will not be aware of it, so nobody set properly the MPTCP ext. End result, we transmit the skb using an hold MPTCP DSS map and that confuses the rx side/corrupt the stream. It requires some concurrent conditions, so it's not deterministic. Resetting the ext on recycle fixes all the current mptcp self tests issues. Apparently only MPTCP has issues with this kind of stray ext, so an alternative would be add an additional mptcp hook in tso_fragment() or in sk_stream_alloc_skb() to always init the ext. Signed-off-by: Paolo Abeni --- include/linux/skbuff.h | 8 ++++++++ include/net/sock.h | 1 + 2 files changed, 9 insertions(+) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 28bdaf978e72..37387ab9f336 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4024,6 +4024,14 @@ static inline void skb_ext_put(struct sk_buff *skb) __skb_ext_put(skb->extensions); } +static inline void skb_ext_clear(struct sk_buff *skb) +{ + if (skb->active_extensions) { + __skb_ext_put(skb->extensions); + skb->active_extensions = 0; + } +} + static inline void __skb_ext_copy(struct sk_buff *dst, const struct sk_buff *src) { diff --git a/include/net/sock.h b/include/net/sock.h index e9d769c04637..bfa695716721 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1469,6 +1469,7 @@ static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb) sk->sk_wmem_queued -= skb->truesize; sk_mem_uncharge(sk, skb->truesize); if (!sk->sk_tx_skb_cache && !skb_cloned(skb)) { + skb_ext_clear(skb); skb_zcopy_clear(skb, true); sk->sk_tx_skb_cache = skb; return; -- 2.22.0