Commit eb4dea58 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

net: Fix percpu counters deadlock 



When we converted the protocol atomic counters such as the orphan
count and the total socket count deadlocks were introduced due to
the mismatch in BH status of the spots that used the percpu counter
operations.

Based on the diagnosis and patch by Peter Zijlstra, this patch
fixes these issues by disabling BH where we may be in process
context.

Reported-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
Tested-by: default avatarIngo Molnar <mingo@elte.hu>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0f23174a

net/dccp/proto.c

+2 −1
Original line number Diff line number Diff line
@@ -964,7 +964,6 @@ adjudge_to_death: 
	state = sk->sk_state;

	sock_hold(sk);

	sock_orphan(sk);

	percpu_counter_inc(sk->sk_prot->orphan_count);



	/*

	 * It is the last release_sock in its life. It will remove backlog.
@@ -978,6 +977,8 @@ adjudge_to_death: 
	bh_lock_sock(sk);

	WARN_ON(sock_owned_by_user(sk));



	percpu_counter_inc(sk->sk_prot->orphan_count);



	/* Have we already been destroyed by a softirq or backlog? */

	if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)

		goto out;

net/ipv4/inet_connection_sock.c

+2 −2
Original line number Diff line number Diff line
@@ -633,8 +633,6 @@ void inet_csk_listen_stop(struct sock *sk) 


		acc_req = req->dl_next;



		percpu_counter_inc(sk->sk_prot->orphan_count);



		local_bh_disable();

		bh_lock_sock(child);

		WARN_ON(sock_owned_by_user(child));
@@ -644,6 +642,8 @@ void inet_csk_listen_stop(struct sock *sk) 


		sock_orphan(child);



		percpu_counter_inc(sk->sk_prot->orphan_count);



		inet_csk_destroy_sock(child);



		bh_unlock_sock(child);

net/ipv4/proc.c

+9 −4
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
#include <net/tcp.h>

#include <net/udp.h>

#include <net/udplite.h>

#include <linux/bottom_half.h>

#include <linux/inetdevice.h>

#include <linux/proc_fs.h>

#include <linux/seq_file.h>
@@ -50,13 +51,17 @@ 
static int sockstat_seq_show(struct seq_file *seq, void *v)

{

	struct net *net = seq->private;

	int orphans, sockets;



	local_bh_disable();

	orphans = percpu_counter_sum_positive(&tcp_orphan_count),

	sockets = percpu_counter_sum_positive(&tcp_sockets_allocated),

	local_bh_enable();



	socket_seq_show(seq);

	seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %d\n",

		   sock_prot_inuse_get(net, &tcp_prot),

		   (int)percpu_counter_sum_positive(&tcp_orphan_count),

		   tcp_death_row.tw_count,

		   (int)percpu_counter_sum_positive(&tcp_sockets_allocated),

		   sock_prot_inuse_get(net, &tcp_prot), orphans,

		   tcp_death_row.tw_count, sockets,

		   atomic_read(&tcp_memory_allocated));

	seq_printf(seq, "UDP: inuse %d mem %d\n",

		   sock_prot_inuse_get(net, &udp_prot),

net/ipv4/tcp.c

+2 −1
Original line number Diff line number Diff line
@@ -1836,7 +1836,6 @@ adjudge_to_death: 
	state = sk->sk_state;

	sock_hold(sk);

	sock_orphan(sk);

	percpu_counter_inc(sk->sk_prot->orphan_count);



	/* It is the last release_sock in its life. It will remove backlog. */

	release_sock(sk);
@@ -1849,6 +1848,8 @@ adjudge_to_death: 
	bh_lock_sock(sk);

	WARN_ON(sock_owned_by_user(sk));



	percpu_counter_inc(sk->sk_prot->orphan_count);



	/* Have we already been destroyed by a softirq or backlog? */

	if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)

		goto out;

net/ipv4/tcp_ipv4.c

+3 −0
Original line number Diff line number Diff line
@@ -51,6 +51,7 @@ 
 */





#include <linux/bottom_half.h>

#include <linux/types.h>

#include <linux/fcntl.h>

#include <linux/module.h>
@@ -1797,7 +1798,9 @@ static int tcp_v4_init_sock(struct sock *sk) 
	sk->sk_sndbuf = sysctl_tcp_wmem[1];

	sk->sk_rcvbuf = sysctl_tcp_rmem[1];



	local_bh_disable();

	percpu_counter_inc(&tcp_sockets_allocated);

	local_bh_enable();



	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE