linux-kernel - commit f5f99309 (sock: do not set sk_err in sock_dequeue_err

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 1 Jun 2017 16:00:48 +0200
From:   Cyril Hrubis <chrubis@...e.cz>
To:     "David S. Miller" <davem@...emloft.net>,
        Shmulik Ladkani <shmulik.ladkani@...il.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>,
        Pravin B Shelar <pshelar@....org>,
        Eric Dumazet <edumazet@...gle.com>,
        Soheil Hassas Yeganeh <soheil@...gle.com>,
        WANG Cong <xiyou.wangcong@...il.com>,
        Yaogong Wang <wygivan@...gle.com>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Al Viro <viro@...iv.linux.org.uk>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: commit f5f99309 (sock: do not set sk_err in sock_dequeue_err_skb)
 has broken ping

Hi!
I've started to wonder why is ping eating 100% CPU shortly after I've
upgraded my machine to 4.10 and here is what I found:

The ping main_loop() sleeps in poll() on its socket, the poll() usually times
out, at least that's what strace suggets which causes ping to sleep for ~1s in
the kernel.

See ping source at:

https://github.com/iputils/iputils/blob/master/ping_common.c#L587

The poll() seems to start returning POLLERR immediatelly after poll() is called
on the socket in a case that connection has dropped for a short while. It seems to be easily reproducible with:

* Starting ping with some ip address i.e. ping 4.2.2.2
* Letting it ping for a minute or so
* Disconnection a WAN cable from your AP
* After a minute or so ping ends up bussy looping on
  poll() that returns with POLLERR immediatelly
* After plugging the cable back the problem gets only
  worse since we now spend 99% of the time bussy looping
  on the poll() syscall
* And my CPU fan starts to scream loudly

I've bisected the problem to this commit:

commit f5f99309fa7481f59a500f0d08f3379cd6424c1f (HEAD, refs/bisect/bad)
Author: Soheil Hassas Yeganeh <soheil@...gle.com>
Date:   Thu Nov 3 18:24:27 2016 -0400

    sock: do not set sk_err in sock_dequeue_err_skb

-- 
Cyril Hrubis
chrubis@...e.cz