From patchwork Wed Nov 7 00:15:35 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julius Werner X-Patchwork-Id: 197603 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C01952C00B4 for ; Wed, 7 Nov 2012 11:16:43 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753527Ab2KGAQ2 (ORCPT ); Tue, 6 Nov 2012 19:16:28 -0500 Received: from mail-pa0-f46.google.com ([209.85.220.46]:59783 "EHLO mail-pa0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752619Ab2KGAQ1 (ORCPT ); Tue, 6 Nov 2012 19:16:27 -0500 Received: by mail-pa0-f46.google.com with SMTP id hz1so713931pad.19 for ; Tue, 06 Nov 2012 16:16:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:x-mailer; bh=Y7OFBjzl2qvwU89NCedYH/ML8MG5otEb0U0/SB6xOc8=; b=XVeH3SMWY7uH4xFUGEWEov53J9uALjMFoKfuqbp3UT5bi86rv8FpvOdS7C87crh5JY 0X2dvbUgWMSphCRScWWh2wc7pycY5umFFookdklw0AzayUQyvR+rsV4ekT0sHlG3RblT YBpa9OQ8St8NvvVSBXuUrk7xC2NGQjF79wC2Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:x-gm-message-state; bh=Y7OFBjzl2qvwU89NCedYH/ML8MG5otEb0U0/SB6xOc8=; b=nrMnib4T8ICk6fvryTOG+jHYdW42P7RQIel6LKg5vSGAwI375l+1X21ru+SgKZOsWP DCvfiV6PjWNSfSaWe3RzD2zd/g2k8cd39mkK/TcxFEbRfw4gCxYu2veMJaXfw6ko6R4C i18pO7/+N2WZmo4zOfU+pQ4ASsqXG16RpoKaDH834HPFGh5JOAI3+8OBuzoiieJ9Y8uF Tc6pHr50nrUp66rQ9IiYrS9Gk3Y6tjH9JONzus4a7sm9S/5kF7ILkA3ti6qQsF3cCaLd RA8IAyQUSBZ+gH1HyyznGbfgXKInUSPWeNGvCL05sCe7wrmGtXzqZdaZXa6UpNqzxlk8 /F+A== Received: by 10.66.84.131 with SMTP id z3mr7319197pay.34.1352247386699; Tue, 06 Nov 2012 16:16:26 -0800 (PST) Received: from jwerner-linux.mtv.corp.google.com (jwerner-linux.mtv.corp.google.com [172.22.72.75]) by mx.google.com with ESMTPS id m7sm7993150paz.3.2012.11.06.16.16.24 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 06 Nov 2012 16:16:25 -0800 (PST) From: Julius Werner To: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org, Patrick McHardy , Hideaki YOSHIFUJI , James Morris , Alexey Kuznetsov , "David S. Miller" , Sameer Nanda , Mandeep Singh Baines , Eric Dumazet , Julius Werner Subject: [PATCH] tcp: Replace infinite loop on recvmsg bug with proper crash Date: Tue, 6 Nov 2012 16:15:35 -0800 Message-Id: <1352247335-10396-1-git-send-email-jwerner@chromium.org> X-Mailer: git-send-email 1.7.7.3 X-Gm-Message-State: ALoCoQlrUlHUWjxqdrrWAko4o53KsJqUOjOuahmsso7NErE2ez0mH/NpPqbfpAoBSRv1ylc/xLtO Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org tcp_recvmsg contains a sanity check that WARNs when there is a gap between the socket's copied_seq and the first buffer in the sk_receive_queue. In theory, the TCP stack makes sure that This Should Never Happen (TM)... however, practice shows that there are still a few bug reports from it out there (and one in my inbox). Unfortunately, when it does happen for whatever reason, the situation is not handled very well: the kernel logs a warning and breaks out of the loop that walks the receive queue. It proceeds to find nothing else to do on the socket and hits sk_wait_data, which cannot block because the receive queue is not empty. As no data was read, the outer while loop repeats (logging the same warning again) ad infinitum until the system's syslog exhausts all available hard drive capacity. This patch improves that behavior by going straight to a proper kernel crash. The cause of the error can be identified right away and the system's hard drive is not unnecessarily strained. Signed-off-by: Julius Werner --- net/ipv4/tcp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 197c000..fcb0927 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1628,7 +1628,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n", *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags)) - break; + BUG(); offset = *seq - TCP_SKB_CB(skb)->seq; if (tcp_hdr(skb)->syn)