From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FROM_EXCESS_BASE64,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1024C43381 for ; Thu, 14 Feb 2019 07:46:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 51331222A4 for ; Thu, 14 Feb 2019 07:46:49 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=samsung.com header.i=@samsung.com header.b="GcShVQ+T" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2437329AbfBNHqr (ORCPT ); Thu, 14 Feb 2019 02:46:47 -0500 Received: from mailout4.samsung.com ([203.254.224.34]:23745 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726358AbfBNHqr (ORCPT ); Thu, 14 Feb 2019 02:46:47 -0500 Received: from epcas1p2.samsung.com (unknown [182.195.41.46]) by mailout4.samsung.com (KnoxPortal) with ESMTP id 20190214074644epoutp049e2b133e306239de6220ad20365fa4f5~DK2Psr2ri0307103071epoutp04N for ; Thu, 14 Feb 2019 07:46:44 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout4.samsung.com 20190214074644epoutp049e2b133e306239de6220ad20365fa4f5~DK2Psr2ri0307103071epoutp04N DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1550130404; bh=nQeJ9EHLEj/88hB3xgO/yrY0t2QxlFW+Ruz7Y+JTRvE=; h=Subject:Reply-To:From:To:CC:Date:References:From; b=GcShVQ+TxwU6vJcZrgUqo9Bwvu9myhlRa8/RcK3ewLJelRJ5Zu+Mgb9FfTxmP0vUl ryGRWS2a5th1ed9TI4lI486Y4KJhiuFYJu4QBdnN1BvTy9iti8c599SS9L/gUlmCBc MCfpKZQqz+rMEtFpTh7nnb3PycRT/1pe644rEFyo= Received: from epsmges1p5.samsung.com (unknown [182.195.40.166]) by epcas1p1.samsung.com (KnoxPortal) with ESMTP id 20190214074643epcas1p163beae727b6b13e6e48ab4827a5ac554~DK2OpJ-F31653516535epcas1p1e; Thu, 14 Feb 2019 07:46:43 +0000 (GMT) X-AuditID: b6c32a39-d65ff7000000106e-a3-5c651ce11f26 Received: from epcas1p3.samsung.com ( [182.195.41.47]) by epsmges1p5.samsung.com (Symantec Messaging Gateway) with SMTP id 36.CC.04206.1EC156C5; Thu, 14 Feb 2019 16:46:41 +0900 (KST) Mime-Version: 1.0 Subject: [Bug reporting] kernel panic during handle the dst unreach icmp msg. Reply-To: soukjin.bae@samsung.com From: =?UTF-8?B?67Cw7ISd7KeE?= To: "netdev@vger.kernel.org" CC: =?UTF-8?B?67Cw7ISd7KeE?= , =?UTF-8?B?67CV7KKF7Ja4?= X-Priority: 3 X-Content-Kind-Code: NORMAL X-Drm-Type: N,general X-Msg-Generator: Mail X-Msg-Type: PERSONAL X-Reply-Demand: N Message-ID: <20190214074641epcms1p1db1c5589f96718a440a166328eec9ebd@epcms1p1> Date: Thu, 14 Feb 2019 16:46:41 +0900 X-CMS-MailID: 20190214074641epcms1p1db1c5589f96718a440a166328eec9ebd Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" CMS-TYPE: 101P X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrGKsWRmVeSWpSXmKPExsWy7bCmvu5DmdQYg/VzNCweTo+1OLZAzGJy 33smB2aPvi2rGD0+b5ILYIrKsclITUxJLVJIzUvOT8nMS7dV8g6Od443NTMw1DW0tDBXUshL zE21VXLxCdB1y8wB2qCkUJaYUwoUCkgsLlbSt7Mpyi8tSVXIyC8usVVKLUjJKTA0KNArTswt Ls1L10vOz7UyNDAwMgWqTMjJmLR0C0vBNcmKf1P2sjYw9ol0MXJwSAiYSHQtMO9i5OQQEtjB KPHxcjBImFdAUOLvDmGQsLCAv8SM213sECWKEluurmWCiFtJzOt4ARZnE7CQOPr+LguILSJg KjHl/A1mEJtZIFeiq/sUWL2EAK/EjPanLBC2tMT25VsZIWxRiZur37LD2O+PzYeKi0i03jvL DGELSjz4uRsqLiVx5N5hoHouILuZUWLrtKWMEE4Lo8TVb7+gOvQlrvTPBNvMK+ArcWXtIbDN LAKqEhM/zWaD+N1FYs8yP4hD5SW2v53DDBJmFtCUWL9LHyLMJ/Huaw8rzP075j2B+kVVYu2z a2wwvzQ23oSq8ZB4eeggMySsAiUW3fnCNoFRbhYiRGchWTYLYdkCRuZVjGKpBcW56anFhgWm yFG4iRGcprQsdzAeO+dziFGAg1GJh7dCKCVGiDWxrLgy9xCjBAezkgjvLbHUGCHelMTKqtSi /Pii0pzU4kOMpkAvT2SWEk3OB6bQvJJ4Q1MjY2NjCxMzczNTYyVx3vUOzjFCAumJJanZqakF qUUwfUwcnFINjKJrJmtW6OmUTlpovHTNodg1Kqq3fG78iZoseP9Z8MrjC82uJB9S/q2+JKKv PHNWmvz17TW1to5hyspGGX9jPZZ4B84qTmg+XGA1SXm1Rgl73rT6Hf9nBSaGanst+KC27ciO 663b/tzXyHLJcN8uZ9zV9nZLRpvsM9d1LZcm35GW9V42LfrqcSWW4oxEQy3mouJEAH6JDgVp AwAA DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20190214074641epcms1p1db1c5589f96718a440a166328eec9ebd References: Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Dear all, https://www.mail-archive.com/netdev@vger.kernel.org/msg256527.html as we concerned before at above mail thread, we faced a problem cased by not removed socket. (from now, 'the socket' means the socket alloced at 0xFFFFFFC0051E5E00) #1. the socket is state in TIME_WAIT1. maybe it's process closed the socket. below is memory dump information with Trace32. (struct sock *)0xFFFFFFC0051E5E00 = 0xFFFFFFC0051E5E00 = end+0x3FF9E4CE00 -> ( __sk_common = ( ... skc_rcv_saddr = 0x0200A8C0, ==> 192.168.0.2 ... skc_state = 4, ==> TIME_WAIT1 ... skc_flags = 0x4301, ==> SOCK_DEAD(0x01) set #2. user changed WIFI AP to another one, so previous netdevice deleted and destroied it's sockets. [60392.948657][4: netd] 02-13 00:39:32.095 5249 5323 I NetdDestroyed 30 sockets on 192.168.0.2 in 2.7 ms [60392.948705][4: netd] 02-13 00:39:32.095 5249 5323 D Netdnotify() code: 614, msg: Address removed 192.168.0.2/24 wlan0 128 0 --> the socket will be exist for a while. because of 'sock_diag_destory() -> tcp_abort()' can not call tcp_done() for the socket. but clearing the socket's sk_write_queue by calling tcp_write_queue_purge(sk). #3. icmp msg(dst unreach) came for sent packet by the socket. to retransmit them, lookup sk and fint it. (because the socket still exist) but it's sk_write_queue was already cleared so has no skb to send. and make the kernel bug. <4>[60392.948306] I[1: ksoftirqd/1: 19] ------------[ cut here ]------------ <0>[60392.948334] I[1: ksoftirqd/1: 19] kernel BUG at net/ipv4/tcp_ipv4.c:519! <2>[60392.948344] I[1: ksoftirqd/1: 19] sec_debug_set_extra_info_fault = BUG / 0xffffff80090351d0 <0>[60392.948386] I[1: ksoftirqd/1: 19] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ... <4>[60392.950676] I[1: ksoftirqd/1: 19] PC is at tcp_v4_err+0x4b0/0x4bc <4>[60392.950684] I[1: ksoftirqd/1: 19] LR is at tcp_v4_err+0x3ac/0x4bc 370 void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) 371 { ... 516 icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX); 517 518 skb = tcp_write_queue_head(sk); 519 BUG_ON(!skb); 520 521 tcp_mstamp_refresh(tp); we know that the line 519 removed on latest state. instead this will be shown to kernel panic. how about below change? do not retransmit packets when socket was already closed. best regards, From: soukjin bae Date: Wen, 14 Jan 2019 14:26:35 +0900 Subject: net: Don't retransmit packets when socket was already closed Signed-off-by: soukjin bae Signed-off-by: jongeon park --- net/ipv4/tcp_ipv4 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv4/tcp_ipv4 b/net/ipv4/tcp_ipv4 index fe4daf6..654bd19 100755 --- a/net/ipv4/tcp_ipv4 +++ b/net/ipv4/tcp_ipv4 @@ -442,6 +465,10 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) err = EPROTO; break; case ICMP_DEST_UNREACH: + /* Don't retransmit packets when socket was already closed */ + if (sock_flag(sk, SOCK_DEAD)) + goto out; + if (code > NR_ICMP_UNREACH) goto out;