netdev - Re: [PATCH net] net: do not leave an empty skb in write queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89i+Np15xv7m1q0E6ZF5ZF2figQ2Ydyf9gdhHFamcCuwi8w@mail.gmail.com>
Date: Thu, 19 Oct 2023 12:29:23 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>
Cc: Soheil Hassas Yeganeh <soheil@...gle.com>, Neal Cardwell <ncardwell@...gle.com>, netdev@...r.kernel.org, 
	eric.dumazet@...il.com, Shakeel Butt <shakeelb@...gle.com>
Subject: Re: [PATCH net] net: do not leave an empty skb in write queue

On Thu, Oct 19, 2023 at 12:02 PM Eric Dumazet <edumazet@...gle.com> wrote:
>
> Under memory stress conditions, tcp_sendmsg_locked()
> might call sk_stream_wait_memory(), thus releasing the socket lock.
>
> If a fresh skb has been allocated prior to this,
> we should not leave it in the write queue otherwise
> tcp_write_xmit() could panic.
>
> This apparently does not happen often, but a future change
> in __sk_mem_raise_allocated() that Shakeel and others are
> considering would increase chances of being hurt.
>
> Under discussion is to remove this controversial part:
>
>     /* Fail only if socket is _under_ its sndbuf.
>      * In this case we cannot block, so that we have to fail.
>      */
>     if (sk->sk_wmem_queued + size >= sk->sk_sndbuf) {
>         /* Force charge with __GFP_NOFAIL */
>         if (memcg_charge && !charged) {
>             mem_cgroup_charge_skmem(sk->sk_memcg, amt,
>                         gfp_memcg_charge() | __GFP_NOFAIL);
>         }
>         return 1;
>     }
>
> Fixes: fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Shakeel Butt <shakeelb@...gle.com>
> ---
>  net/ipv4/tcp.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index d3456cf840de35b28a6adb682e27d426b0a60f84..a9a49e1d3da11bc6f9ed3baad5dd581400d50c69 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -927,10 +927,11 @@ int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
>         return mss_now;
>  }
>
> -/* In some cases, both sendmsg() could have added an skb to the write queue,
> - * but failed adding payload on it.  We need to remove it to consume less
> +/* In some cases, sendmsg() could have added an skb to the write queue,
> + * but failed adding payload on it. We need to remove it to consume less
>   * memory, but more importantly be able to generate EPOLLOUT for Edge Trigger
> - * epoll() users.
> + * epoll() users. Another reason is that tcp_write_xmit() does not like
> + * finding an empty skb in the write queue.
>   */
>  void tcp_remove_empty_skb(struct sock *sk)
>  {
> @@ -1293,6 +1294,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>                         tcp_push(sk, flags & ~MSG_MORE, mss_now,
>                                  TCP_NAGLE_PUSH, size_goal);
>
> +               tcp_remove_empty_skb(sk);

I will send a v2, moving this before calling tcp_push(), to be on the safe side.