From patchwork Thu Apr 19 14:01:52 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhu Yanjun X-Patchwork-Id: 10350391 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CC63D6023A for ; Thu, 19 Apr 2018 13:58:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BB19A28A0F for ; Thu, 19 Apr 2018 13:58:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AFBD528A15; Thu, 19 Apr 2018 13:58:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3A24E28A0F for ; Thu, 19 Apr 2018 13:58:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750989AbeDSN6o (ORCPT ); Thu, 19 Apr 2018 09:58:44 -0400 Received: from userp2120.oracle.com ([156.151.31.85]:44238 "EHLO userp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751136AbeDSN6n (ORCPT ); Thu, 19 Apr 2018 09:58:43 -0400 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w3JDuP30131325; Thu, 19 Apr 2018 13:58:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id; s=corp-2017-10-26; bh=4mHQXA2WMPXG3Z7pdoEQvz6onK8nCjoe6prBiR2B+6c=; b=wJaRLaVT00EnlUID70mwwuL+Tic+wbzAnaxcJcrzGhZrAVg873HIkepfNj30EEy/Y1Cc TxVKetMTviJq4nDQ2c2ND6R1HAyPL8oMqCO9Dj5/enTYfsAHV0FRr14lIh5P1fYukiKW Am8kTFdmo/8RdGrjjX3MIg1X7V9sfJKHY184Yi7rctaW9IQkfWa6Adi+BSKJuvsux4fC DWQmlSIDVs8B2ue6MT1HPzJrzxZSut1g+/JUaLOYCWC5FjCcbF0oSS39L+Huo1tXNQaW EDqtxZpswCyiAE6uc7p+ubMsjCKNfCmVbpf7O4z0133ji8dDJ4fVxYM6eczJ6SnD9jcr SQ== Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp2120.oracle.com with ESMTP id 2hdrxp7gby-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 19 Apr 2018 13:58:22 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w3JDwL6B002290 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 19 Apr 2018 13:58:22 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w3JDwLBF017507; Thu, 19 Apr 2018 13:58:21 GMT Received: from office-bj2017.cn.oracle.com (/10.182.69.78) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 19 Apr 2018 06:58:21 -0700 From: Zhu Yanjun To: monis@mellanox.com, dledford@redhat.com, jgg@ziepe.ca, linux-rdma@vger.kernel.org Subject: [PATCH 1/1] IB/rxe: avoid double kfree_skb Date: Thu, 19 Apr 2018 10:01:52 -0400 Message-Id: <1524146512-4188-1-git-send-email-yanjun.zhu@oracle.com> X-Mailer: git-send-email 2.7.4 X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8867 signatures=668698 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=2 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=868 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1804190125 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When skb is dropped by iptables rules, the skb is freed at the same time -EPERM is returned. So in softroce, it is not necessary to free skb again. Or else, crash will occur. The steps to reproduce: server client --------- --------- |1.1.1.1|<----rxe-channel--->|1.1.1.2| --------- --------- On server: rping -s -a 1.1.1.1 -v -C 10000 -S 512 On client: rping -c -a 1.1.1.1 -v -C 10000 -S 512 The kernel configs CONFIG_DEBUG_KMEMLEAK and CONFIG_DEBUG_OBJECTS are enabled on both server and client. When rping runs, run the following command in server: iptables -I OUTPUT -p udp --dport 4791 -j DROP Without this patch, crash will occur. CC: Srinivas Eeda CC: Junxiao Bi Signed-off-by: Zhu Yanjun Reviewed-by: Yuval Shaia --- drivers/infiniband/sw/rxe/rxe_net.c | 3 +++ drivers/infiniband/sw/rxe/rxe_req.c | 5 +++-- drivers/infiniband/sw/rxe/rxe_resp.c | 9 ++++++--- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c index 9da6e37..2094434 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.c +++ b/drivers/infiniband/sw/rxe/rxe_net.c @@ -511,6 +511,9 @@ int rxe_send(struct rxe_pkt_info *pkt, struct sk_buff *skb) if (unlikely(net_xmit_eval(err))) { pr_debug("error sending packet: %d\n", err); + /* -EPERM means the skb is dropped and freed. */ + if (err == -EPERM) + return -EPERM; return -EAGAIN; } diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c index 7bdaf71..9d2efec 100644 --- a/drivers/infiniband/sw/rxe/rxe_req.c +++ b/drivers/infiniband/sw/rxe/rxe_req.c @@ -727,8 +727,9 @@ int rxe_requester(void *arg) rollback_state(wqe, qp, &rollback_wqe, rollback_psn); - if (ret == -EAGAIN) { - kfree_skb(skb); + if ((ret == -EAGAIN) || (ret == -EPERM)) { + if (ret == -EAGAIN) + kfree_skb(skb); rxe_run_task(&qp->req.task, 1); goto exit; } diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index a65c996..6bdf9b2 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -742,7 +742,8 @@ static enum resp_states read_reply(struct rxe_qp *qp, err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb); if (err) { pr_err("Failed sending RDMA reply.\n"); - kfree_skb(skb); + if (err != -EPERM) + kfree_skb(skb); return RESPST_ERR_RNR; } @@ -956,7 +957,8 @@ static int send_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt, err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb); if (err) { pr_err_ratelimited("Failed sending ack\n"); - kfree_skb(skb); + if (err != -EPERM) + kfree_skb(skb); } err1: @@ -1141,7 +1143,8 @@ static enum resp_states duplicate_request(struct rxe_qp *qp, if (rc) { pr_err("Failed resending result. This flow is not handled - skb ignored\n"); rxe_drop_ref(qp); - kfree_skb(skb_copy); + if (rc != -EPERM) + kfree_skb(skb_copy); rc = RESPST_CLEANUP; goto out; }