linux-toradex.git/net/ipv4/tcp_timer.c, branch v3.7.9

tcp: Reject invalid ack_seq to Fast Open sockets

2012-10-23T06:42:56+00:00

A packet with an invalid ack_seq may cause a TCP Fast Open socket to switch
to the unexpected TCP_CLOSING state, triggering a BUG_ON kernel panic.

When a FIN packet with an invalid ack_seq# arrives at a socket in
the TCP_FIN_WAIT1 state, rather than discarding the packet, the current
code will accept the FIN, causing state transition to TCP_CLOSING.

This may be a small deviation from RFC793, which seems to say that the
packet should be dropped. Unfortunately I did not expect this case for
Fast Open hence it will trigger a BUG_ON panic.

It turns out there is really nothing bad about a TFO socket going into
TCP_CLOSING state so I could just remove the BUG_ON statements. But after
some thought I think it's better to treat this case like TCP_SYN_RECV
and return a RST to the confused peer who caused the unacceptable ack_seq
to be generated in the first place.

Signed-off-by: H.K. Jerry Chu 
Cc: Neal Cardwell 
Cc: Yuchung Cheng 
Acked-by: Yuchung Cheng 
Acked-by: Eric Dumazet 
Acked-by: Neal Cardwell 
Signed-off-by: David S. Miller

tcp: TCP Fast Open Server - support TFO listeners

2012-09-01T00:02:19+00:00

This patch builds on top of the previous patch to add the support
for TFO listeners. This includes -

1. allocating, properly initializing, and managing the per listener
fastopen_queue structure when TFO is enabled

2. changes to the inet_csk_accept code to support TFO. E.g., the
request_sock can no longer be freed upon accept(), not until 3WHS
finishes

3. allowing a TCP_SYN_RECV socket to properly poll() and sendmsg()
if it's a TFO socket

4. properly closing a TFO listener, and a TFO socket before 3WHS
finishes

5. supporting TCP_FASTOPEN socket option

6. modifying tcp_check_req() to use to check a TFO socket as well
as request_sock

7. supporting TCP's TFO cookie option

8. adding a new SYN-ACK retransmit handler to use the timer directly
off the TFO socket rather than the listener socket. Note that TFO
server side will not retransmit anything other than SYN-ACK until
the 3WHS is completed.

The patch also contains an important function
"reqsk_fastopen_remove()" to manage the somewhat complex relation
between a listener, its request_sock, and the corresponding child
socket. See the comment above the function for the detail.

Signed-off-by: H.K. Jerry Chu 
Cc: Yuchung Cheng 
Cc: Neal Cardwell 
Cc: Eric Dumazet 
Cc: Tom Herbert 
Signed-off-by: David S. Miller

tcp: fix possible socket refcount problem

2012-08-21T21:42:23+00:00

Commit 6f458dfb40 (tcp: improve latencies of timer triggered events)
added bug leading to following trace :

[ 2866.131281] IPv4: Attempt to release TCP socket in state 1 ffff880019ec0000
[ 2866.131726]
[ 2866.132188] =========================
[ 2866.132281] [ BUG: held lock freed! ]
[ 2866.132281] 3.6.0-rc1+ #622 Not tainted
[ 2866.132281] -------------------------
[ 2866.132281] kworker/0:1/652 is freeing memory ffff880019ec0000-ffff880019ec0a1f, with a lock still held there!
[ 2866.132281]  (sk_lock-AF_INET-RPC){+.+...}, at: [] tcp_sendmsg+0x29/0xcc6
[ 2866.132281] 4 locks held by kworker/0:1/652:
[ 2866.132281]  #0:  (rpciod){.+.+.+}, at: [] process_one_work+0x1de/0x47f
[ 2866.132281]  #1:  ((&task->u.tk_work)){+.+.+.}, at: [] process_one_work+0x1de/0x47f
[ 2866.132281]  #2:  (sk_lock-AF_INET-RPC){+.+...}, at: [] tcp_sendmsg+0x29/0xcc6
[ 2866.132281]  #3:  (&icsk->icsk_retransmit_timer){+.-...}, at: [] run_timer_softirq+0x1ad/0x35f
[ 2866.132281]
[ 2866.132281] stack backtrace:
[ 2866.132281] Pid: 652, comm: kworker/0:1 Not tainted 3.6.0-rc1+ #622
[ 2866.132281] Call Trace:
[ 2866.132281]    [] debug_check_no_locks_freed+0x112/0x159
[ 2866.132281]  [] ? __sk_free+0xfd/0x114
[ 2866.132281]  [] kmem_cache_free+0x6b/0x13a
[ 2866.132281]  [] __sk_free+0xfd/0x114
[ 2866.132281]  [] sk_free+0x1c/0x1e
[ 2866.132281]  [] tcp_write_timer+0x51/0x56
[ 2866.132281]  [] run_timer_softirq+0x218/0x35f
[ 2866.132281]  [] ? run_timer_softirq+0x1ad/0x35f
[ 2866.132281]  [] ? rb_commit+0x58/0x85
[ 2866.132281]  [] ? tcp_write_timer_handler+0x148/0x148
[ 2866.132281]  [] __do_softirq+0xcb/0x1f9
[ 2866.132281]  [] ? _raw_spin_unlock+0x29/0x2e
[ 2866.132281]  [] call_softirq+0x1c/0x30
[ 2866.132281]  [] do_softirq+0x4a/0xa6
[ 2866.132281]  [] irq_exit+0x51/0xad
[ 2866.132281]  [] do_IRQ+0x9d/0xb4
[ 2866.132281]  [] common_interrupt+0x6f/0x6f
[ 2866.132281]    [] ? sched_clock_cpu+0x58/0xd1
[ 2866.132281]  [] ? _raw_spin_unlock_irqrestore+0x4c/0x56
[ 2866.132281]  [] mod_timer+0x178/0x1a9
[ 2866.132281]  [] sk_reset_timer+0x19/0x26
[ 2866.132281]  [] tcp_rearm_rto+0x99/0xa4
[ 2866.132281]  [] tcp_event_new_data_sent+0x6e/0x70
[ 2866.132281]  [] tcp_write_xmit+0x7de/0x8e4
[ 2866.132281]  [] ? __alloc_skb+0xa0/0x1a1
[ 2866.132281]  [] __tcp_push_pending_frames+0x2e/0x8a
[ 2866.132281]  [] tcp_sendmsg+0xb32/0xcc6
[ 2866.132281]  [] inet_sendmsg+0xaa/0xd5
[ 2866.132281]  [] ? inet_autobind+0x5f/0x5f
[ 2866.132281]  [] ? trace_clock_local+0x9/0xb
[ 2866.132281]  [] sock_sendmsg+0xa3/0xc4
[ 2866.132281]  [] ? rb_reserve_next_event+0x26f/0x2d5
[ 2866.132281]  [] ? native_sched_clock+0x29/0x6f
[ 2866.132281]  [] ? sched_clock+0x9/0xd
[ 2866.132281]  [] ? trace_clock_local+0x9/0xb
[ 2866.132281]  [] kernel_sendmsg+0x37/0x43
[ 2866.132281]  [] xs_send_kvec+0x77/0x80
[ 2866.132281]  [] xs_sendpages+0x6f/0x1a0
[ 2866.132281]  [] ? try_to_del_timer_sync+0x55/0x61
[ 2866.132281]  [] xs_tcp_send_request+0x55/0xf1
[ 2866.132281]  [] xprt_transmit+0x89/0x1db
[ 2866.132281]  [] ? call_connect+0x3c/0x3c
[ 2866.132281]  [] call_transmit+0x1c5/0x20e
[ 2866.132281]  [] __rpc_execute+0x6f/0x225
[ 2866.132281]  [] ? call_connect+0x3c/0x3c
[ 2866.132281]  [] rpc_async_schedule+0x28/0x34
[ 2866.132281]  [] process_one_work+0x24d/0x47f
[ 2866.132281]  [] ? process_one_work+0x1de/0x47f
[ 2866.132281]  [] ? __rpc_execute+0x225/0x225
[ 2866.132281]  [] worker_thread+0x236/0x317
[ 2866.132281]  [] ? process_scheduled_works+0x2f/0x2f
[ 2866.132281]  [] kthread+0x9a/0xa2
[ 2866.132281]  [] kernel_thread_helper+0x4/0x10
[ 2866.132281]  [] ? retint_restore_args+0x13/0x13
[ 2866.132281]  [] ? __init_kthread_worker+0x5a/0x5a
[ 2866.132281]  [] ? gs_change+0x13/0x13
[ 2866.308506] IPv4: Attempt to release TCP socket in state 1 ffff880019ec0000
[ 2866.309689] =============================================================================
[ 2866.310254] BUG TCP (Not tainted): Object already free
[ 2866.310254] -----------------------------------------------------------------------------
[ 2866.310254]

The bug comes from the fact that timer set in sk_reset_timer() can run
before we actually do the sock_hold(). socket refcount reaches zero and
we free the socket too soon.

timer handler is not allowed to reduce socket refcnt if socket is owned
by the user, or we need to change sk_reset_timer() implementation.

We should take a reference on the socket in case TCP_DELACK_TIMER_DEFERRED
or TCP_DELACK_TIMER_DEFERRED bit are set in tsq_flags

Also fix a typo in tcp_delack_timer(), where TCP_WRITE_TIMER_DEFERRED
was used instead of TCP_DELACK_TIMER_DEFERRED.

For consistency, use same socket refcount change for TCP_MTU_REDUCED_DEFERRED,
even if not fired from a timer.

Reported-by: Fengguang Wu 
Tested-by: Fengguang Wu 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

tcp: improve latencies of timer triggered events

2012-07-20T17:59:41+00:00

Modern TCP stack highly depends on tcp_write_timer() having a small
latency, but current implementation doesn't exactly meet the
expectations.

When a timer fires but finds the socket is owned by the user, it rearms
itself for an additional delay hoping next run will be more
successful.

tcp_write_timer() for example uses a 50ms delay for next try, and it
defeats many attempts to get predictable TCP behavior in term of
latencies.

Use the recently introduced tcp_release_cb(), so that the user owning
the socket will call various handlers right before socket release.

This will permit us to post a followup patch to address the
tcp_tso_should_defer() syndrome (some deferred packets have to wait
RTO timer to be transmitted, while cwnd should allow us to send them
sooner)

Signed-off-by: Eric Dumazet 
Cc: Tom Herbert 
Cc: Yuchung Cheng 
Cc: Neal Cardwell 
Cc: Nandita Dukkipati 
Cc: H.K. Jerry Chu 
Cc: John Heffner 
Signed-off-by: David S. Miller

tcp: early retransmit: delayed fast retransmit

2012-05-03T00:56:10+00:00

Implementing the advanced early retransmit (sysctl_tcp_early_retrans==2).
Delays the fast retransmit by an interval of RTT/4. We borrow the
RTO timer to implement the delay. If we receive another ACK or send
a new packet, the timer is cancelled and restored to original RTO
value offset by time elapsed.  When the delayed-ER timer fires,
we enter fast recovery and perform fast retransmit.

Signed-off-by: Yuchung Cheng 
Acked-by: Neal Cardwell 
Signed-off-by: David S. Miller

net: ipv4: Standardize prefixes for message logging

2012-03-13T00:05:21+00:00

Add #define pr_fmt(fmt) as appropriate.

Add "IPv4: ", "TCP: ", and "IPsec: " to appropriate files.
Standardize on "UDPLite: " for appropriate uses.
Some prefixes were previously "UDPLITE: " and "UDP-Lite: ".

Add KBUILD_MODNAME ": " to icmp and gre.
Remove embedded prefixes as appropriate.

Add missing "\n" to pr_info in gre.c.

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

net: Disambiguate kernel message

2012-02-01T19:41:50+00:00

Some of our machines were reporting:

TCP: too many of orphaned sockets

even when the number of orphaned sockets was well below the
limit.

We print a different message depending on whether we're out
of TCP memory or there are too many orphaned sockets.

Also move the check out of line and cleanup the messages
that were printed.

Signed-off-by: Arun Sharma 
Suggested-by: Mohan Srinivasan 
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: David Miller 
Cc: Glauber Costa 
Cc: Ingo Molnar 
Cc: Joe Perches 
Signed-off-by: David S. Miller

net: fix assignment of 0/1 to bool variables.

2011-12-20T03:27:29+00:00

DaveM said:
   Please, this kind of stuff rots forever and not using bool properly
   drives me crazy.

Joe Perches  gave me the spatch script:

	@@
	bool b;
	@@
	-b = 0
	+b = false
	@@
	bool b;
	@@
	-b = 1
	+b = true

I merely installed coccinelle, read the documentation and took credit.

Signed-off-by: Rusty Russell 
Signed-off-by: David S. Miller

foundations of per-cgroup memory pressure controlling.

2011-12-13T00:04:10+00:00

This patch replaces all uses of struct sock fields' memory_pressure,
memory_allocated, sockets_allocated, and sysctl_mem to acessor
macros. Those macros can either receive a socket argument, or a mem_cgroup
argument, depending on the context they live in.

Since we're only doing a macro wrapping here, no performance impact at all is
expected in the case where we don't have cgroups disabled.

Signed-off-by: Glauber Costa 
Reviewed-by: Hiroyouki Kamezawa 
CC: David S. Miller 
CC: Eric W. Biederman 
CC: Eric Dumazet 
Signed-off-by: David S. Miller

net: use IS_ENABLED(CONFIG_IPV6)

2011-12-11T23:25:16+00:00

Instead of testing defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller