From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B603C43381 for ; Wed, 20 Feb 2019 16:19:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5AC2B20859 for ; Wed, 20 Feb 2019 16:19:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727599AbfBTQTM (ORCPT ); Wed, 20 Feb 2019 11:19:12 -0500 Received: from relay.sw.ru ([185.231.240.75]:44792 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727582AbfBTQTM (ORCPT ); Wed, 20 Feb 2019 11:19:12 -0500 Received: from [172.16.24.21] by relay.sw.ru with esmtp (Exim 4.91) (envelope-from ) id 1gwUaR-0003FG-0D; Wed, 20 Feb 2019 19:19:07 +0300 Subject: Re: skb_can_coalesce() merges tcp frags with XFS-related slab objects To: Eric Dumazet , "David S. Miller" Cc: Linux Kernel Network Developers , Ilya Dryomov References: <2dc88af7-3d29-58e1-00e0-127d1f798c28@gmail.com> From: Vasily Averin Message-ID: Date: Wed, 20 Feb 2019 19:19:06 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: <2dc88af7-3d29-58e1-00e0-127d1f798c28@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 2/20/19 6:53 PM, Eric Dumazet wrote: > On 02/20/2019 05:34 AM, Vasily Averin wrote: >> Dear David, >> >> currently do_tcp_sendpages() calls skb_can_coalesce() to merge proper tcp fragments. >> If these fragments are slab objects and the data is not transferred out of the local host >> then tcp_recvmsg() can crash host on BUG_ON (see [2] below). >> >> There is known usecase when slab objects are provided to tcp_sendpage: >> XFS over locally landed network blockdevice. >> >> I found few such cases: >> - _drbd_send_page() had PageSlab() check log time ago. >> - recently Ilya Dryomov fixed it in ceph >> by commit 7e241f647dc7 "libceph: fall back to sendmsg for slab pages" >> >> Recently OpenVZ team noticed this problem during experiments with >> XFS over locally-landed iscsi target. >> >> I would note: triggered BUG is not a real problem but false alert, >> that though crashes host. >> >> I can fix last problem by adding PageSlab() into iscsi_tcp_segment_map(), >> however it does not fix the problem completely, >> there are chances that the problem will be reproduced again with some other filesystems >> or with some other kind of network blockdevice. >> >> David, what do you think, is it probably better to add PageSlab() check >> directly into skb_can_coalesce()? (see [1] below) >> > > No, this would be wrong. > > There is no way a page fragment can be backed by slab object, > since a page fragment can be shared (the page refcount needs to be manipulated, without slab/slub > being aware of this) Thank you for explanation, though this happen in real life and triggers BUG_ON only if receiving side is located on the same host. Is it probably makes sense to add WARN_ON into skb_can_coalesce to detect such cases? > Please fix the callers. Ok, will do it.