linux-kernel - Re: [PATCH net v6 3/3] net: sched: fix tx action reschedule issue with stopped queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 May 2021 17:04:59 +0800
From:   Yunsheng Lin <linyunsheng@...wei.com>
To:     Jakub Kicinski <kuba@...nel.org>
CC:     <davem@...emloft.net>, <olteanv@...il.com>, <ast@...nel.org>,
        <daniel@...earbox.net>, <andriin@...com>, <edumazet@...gle.com>,
        <weiwan@...gle.com>, <cong.wang@...edance.com>,
        <ap420073@...il.com>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <linuxarm@...neuler.org>,
        <mkl@...gutronix.de>, <linux-can@...r.kernel.org>,
        <jhs@...atatu.com>, <xiyou.wangcong@...il.com>, <jiri@...nulli.us>,
        <andrii@...nel.org>, <kafai@...com>, <songliubraving@...com>,
        <yhs@...com>, <john.fastabend@...il.com>, <kpsingh@...nel.org>,
        <bpf@...r.kernel.org>, <jonas.bonn@...rounds.com>,
        <pabeni@...hat.com>, <mzhivich@...mai.com>, <johunt@...mai.com>,
        <albcamus@...il.com>, <kehuan.feng@...il.com>,
        <a.fatoum@...gutronix.de>, <atenart@...nel.org>,
        <alexander.duyck@...il.com>, <hdanton@...a.com>, <jgross@...e.com>,
        <JKosina@...e.com>, <mkubecek@...e.cz>, <bjorn@...nel.org>,
        <alobakin@...me>
Subject: Re: [PATCH net v6 3/3] net: sched: fix tx action reschedule issue
 with stopped queue

On 2021/5/11 12:22, Jakub Kicinski wrote:
> On Mon, 10 May 2021 09:42:36 +0800 Yunsheng Lin wrote:
>> The netdev qeueue might be stopped when byte queue limit has
>> reached or tx hw ring is full, net_tx_action() may still be
>> rescheduled endlessly if STATE_MISSED is set, which consumes
>> a lot of cpu without dequeuing and transmiting any skb because
>> the netdev queue is stopped, see qdisc_run_end().
>>
>> This patch fixes it by checking the netdev queue state before
>> calling qdisc_run() and clearing STATE_MISSED if netdev queue is
>> stopped during qdisc_run(), the net_tx_action() is recheduled
>> again when netdev qeueue is restarted, see netif_tx_wake_queue().
>>
>> Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking")
>> Reported-by: Michal Kubecek <mkubecek@...e.cz>
>> Signed-off-by: Yunsheng Lin <linyunsheng@...wei.com>
> 
> Patches 1 and 2 look good to me but this one I'm not 100% sure.
> 
>> @@ -251,8 +253,10 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
>>  	*validate = true;
>>  
>>  	if ((q->flags & TCQ_F_ONETXQUEUE) &&
>> -	    netif_xmit_frozen_or_stopped(txq))
>> +	    netif_xmit_frozen_or_stopped(txq)) {
>> +		clear_bit(__QDISC_STATE_MISSED, &q->state);
>>  		return skb;
>> +	}
> 
> The queues are woken asynchronously without holding any locks via
> netif_tx_wake_queue(). Theoretically we can have a situation where:
> 
> CPU 0                            CPU 1   
>   .                                .
> dequeue_skb()                      .
>   netif_xmit_frozen..() # true     .
>   .                              [IRQ]
>   .                              netif_tx_wake_queue()
>   .                              <end of IRQ>
>   .                              netif_tx_action()
>   .                              set MISSED
>   clear MISSED
>   return NULL
> ret from qdisc_restart()
> ret from __qdisc_run()
> qdisc_run_end()
> -> MISSED not set

Yes, the above does seems to have the above data race.

As my understanding, there is two ways to fix the above data race:
1. do not clear the STATE_MISSED for netif_xmit_frozen_or_stopped()
   case, just check the netif_xmit_frozen_or_stopped() before
   calling __netif_schedule() at the end of qdisc_run_end(). This seems
   to only work with qdisc with TCQ_F_ONETXQUEUE flag because it seems
   we can only check the netif_xmit_frozen_or_stopped() with q->dev_queue,
   I am not sure q->dev_queue is pointint to which netdev queue when qdisc
   is not set with TCQ_F_ONETXQUEUE flag.

2. clearing the STATE_MISSED for netif_xmit_frozen_or_stopped() case
   as this patch does, and protect the __netif_schedule() with q->seqlock
   for netif_tx_wake_queue(), which might bring unnecessary overhead for
   non-stopped queue case

Any better idea?

> 
> .
>