Netdev List
 help / color / mirror / Atom feed
From: Eric Dumazet <eric.dumazet@gmail.com>
To: Jarek Poplawski <jarkao2@gmail.com>
Cc: Nick Bowler <nbowler@elliptictech.com>,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	"David S. Miller" <davem@davemloft.net>
Subject: Re: Regression, bisected: reference leak with IPSec since ~2.6.31
Date: Tue, 21 Sep 2010 13:58:30 +0200	[thread overview]
Message-ID: <1285070310.2617.359.camel@edumazet-laptop> (raw)
In-Reply-To: <20100921104821.GA8986@ff.dom.local>

Le mardi 21 septembre 2010 à 10:48 +0000, Jarek Poplawski a écrit :

> But if you were honest about caches there is no reason to be smart
> no more. ;-)
> 
> Below is your patch mostly as an example only that I didn't mean
> nothing complex (ipv4 only, not compiled).
> 
> Jarek P.
> ---
> 
> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index 04b6989..049d61f 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -490,7 +490,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
>  	if (skb_has_frags(skb)) {
>  		struct sk_buff *frag;
>  		int first_len = skb_pagelen(skb);
> -		int truesizes = 0;
>  
>  		if (first_len - hlen > mtu ||
>  		    ((first_len - hlen) & 7) ||
> @@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
>  			if (frag->len > mtu ||
>  			    ((frag->len & 7) && frag->next) ||
>  			    skb_headroom(frag) < hlen)
> -			    goto slow_path;
> +			    goto slow_path_clean;
>  
>  			/* Partially cloned skb? */
>  			if (skb_shared(frag))
> -				goto slow_path;
> +				goto slow_path_clean;
>  
>  			BUG_ON(frag->sk);
>  			if (skb->sk) {
>  				frag->sk = skb->sk;
>  				frag->destructor = sock_wfree;
> +				skb->truesize -= frag->truesize;
>  			}
> -			truesizes += frag->truesize;
>  		}
>  
>  		/* Everything is OK. Generate! */
> @@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
>  		frag = skb_shinfo(skb)->frag_list;
>  		skb_frag_list_init(skb);
>  		skb->data_len = first_len - skb_headlen(skb);
> -		skb->truesize -= truesizes;
>  		skb->len = first_len;
>  		iph->tot_len = htons(first_len);
>  		iph->frag_off = htons(IP_MF);
> @@ -576,6 +574,17 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
>  		}
>  		IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
>  		return err;
> +
> +slow_path_clean:
> +		if (skb->sk) {
> +			skb_walk_frags(skb, frag) {
> +				if (!frag->sk)
> +					break;
> +				frag->sk = NULL;
> +				frag->destructor = NULL;
> +				skb->truesize += frag->truesize;
> +			}
> +		}
>  	}
>  
>  slow_path:

Nice try, but this adds a bug unfortunately, or if you prefer makes the
"BUG_ON(frag->sk);" being not fully covered.

If we hit slow path, and one or more frags had frag->sk set, we silently
unset it, instead of a nice BUG_ON().

If you really want to have a slow_path_clean, you should use a different
frag2 iterator :

slow_path_clean:
       if (skb->sk) {
                skb_walk_frags(skb, frag2) {
                       if (frag2 == frag)
                               break;
                       frag2->sk = NULL;
                       frag2->destructor = NULL;
                       skb->truesize += frag2->truesize;
               }
       }

Face it, this is too complex for net-2.6, could we just fix the bug, and
'optimize' later ?

  reply	other threads:[~2010-09-21 11:58 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-09-20 17:44 Regression, bisected: reference leak with IPSec since ~2.6.31 Nick Bowler
2010-09-20 18:20 ` Eric Dumazet
2010-09-20 19:52   ` Nick Bowler
2010-09-20 20:00     ` David Miller
2010-09-20 21:23       ` Nick Bowler
2010-09-20 20:17     ` Eric Dumazet
2010-09-20 21:31       ` Eric Dumazet
2010-09-21  6:16         ` [PATCH] ip : take care of last fragment in ip_append_data Eric Dumazet
2010-09-21 23:38           ` David Miller
2010-09-22  4:44             ` Eric Dumazet
2010-09-22  4:53               ` David Miller
2010-09-24 21:42           ` David Miller
2010-09-21  9:12         ` Regression, bisected: reference leak with IPSec since ~2.6.31 Jarek Poplawski
2010-09-21  9:21           ` Eric Dumazet
2010-09-21  9:38             ` Jarek Poplawski
2010-09-21  9:55               ` Eric Dumazet
2010-09-21 10:07                 ` Eric Dumazet
2010-09-21 10:48                   ` Jarek Poplawski
2010-09-21 11:58                     ` Eric Dumazet [this message]
2010-09-21 12:39                       ` Jarek Poplawski
2010-09-21 14:05         ` Nick Bowler
2010-09-21 14:16           ` [PATCH] ip : fix truesize mismatch in ip fragmentation Eric Dumazet
2010-09-21 15:58             ` [PATCH v3] ip: " Eric Dumazet
2010-09-21 16:26               ` Henrique de Moraes Holschuh
2010-09-21 16:31                 ` Eric Dumazet
2010-09-21 18:09                   ` Henrique de Moraes Holschuh
2010-09-21 19:24                     ` David Miller
2010-09-21 23:06                       ` Henrique de Moraes Holschuh
2010-09-21 17:50               ` Jarek Poplawski
2010-09-21 18:47                 ` Eric Dumazet
2010-09-21 19:21                   ` Jarek Poplawski
2010-09-21 22:15                     ` David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1285070310.2617.359.camel@edumazet-laptop \
    --to=eric.dumazet@gmail.com \
    --cc=davem@davemloft.net \
    --cc=jarkao2@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nbowler@elliptictech.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox