在 2022/5/28 5:37, Cong Wang 写道:
On Tue, May 24, 2022 at 03:53:11PM +0800, Wang Yufen wrote:
During TCP sockmap redirect pressure test, the following warning is triggered:
WARNING: CPU: 3 PID: 2145 at net/core/stream.c:205 sk_stream_kill_queues+0xbc/0xd0
CPU: 3 PID: 2145 Comm: iperf Kdump: loaded Tainted: G W 5.10.0+ #9
Call Trace:
inet_csk_destroy_sock+0x55/0x110
inet_csk_listen_stop+0xbb/0x380
tcp_close+0x41b/0x480
inet_release+0x42/0x80
__sock_release+0x3d/0xa0
sock_close+0x11/0x20
__fput+0x9d/0x240
task_work_run+0x62/0x90
exit_to_user_mode_prepare+0x110/0x120
syscall_exit_to_user_mode+0x27/0x190
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The reason we observed is that:
When the listener is closing, a connection may have completed the three-way
handshake but not accepted, and the client has sent some packets. The child
sks in accept queue release by inet_child_forget()->inet_csk_destroy_sock(),
but psocks of child sks have not released.
Hm, in this scenario, how does the child socket end up in the sockmap?
Clearly user-space does not have a chance to get an fd yet.
And, how does your patch work? Since the child sock does not even inheirt
the sock proto after clone (see the comments above tcp_bpf_clone()) at
all?
Thanks.
.
My test cases are as follows:
__section("sockops")
int bpf_sockmap(struct bpf_sock_ops *skops)
{
switch (skops->op) {
case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
...
bpf_sock_hash_update(skops, &sock_ops_map, &key, BPF_NOEXIST);
break;
...
}
__section("sk_msg")
int bpf_redir(struct sk_msg_md *msg)
{
...
bpf_msg_redirect_hash(msg, &sock_ops_map, &key, BPF_F_INGRESS);
return SK_PASS;
}
//tcp_server
int main(char **argv)
{
int sk = 0;
int port, ret;
struct sockaddr_in addr;
signal(SIGCHLD, SIG_IGN);
sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (sk < 0) {
perror("Can't create socket");
return -1;
}
port = atoi(argv[1]);
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = htonl(INADDR_ANY);
addr.sin_port = htons(port);
printf("Binding to port %d\n", port);
ret = bind(sk, (struct sockaddr *)&addr, sizeof(addr));
if (ret < 0) {
perror("Can't bind socket");
return -1;
}
ret = listen(sk, size);
if (ret < 0) {
perror("Can't put sock to listen");
return -1;
}
printf("Waiting for connections\n");
while (1) {
//not accpet
sleep(1);
}
}
//tcp_client
int main(char **argv)
{
int port, write_size;
int val[10], rval[10];
int sk = 0;
port = atoi(argv[2]);
val[0] = 1;
sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (sk < 0) {
perror("Can't create socket");
return -1;
}
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
inet_aton(argv[1], &addr.sin_addr);
addr.sin_port = htons(port);
ret = connect(sk[i], (struct sockaddr *)&addr, sizeof(addr));
if (ret < 0) {
perror("Can't connect");
return -1;
}
while (1) {
printf("send %d -> %d\n", val[0], val[0]);
write(sk, &val, sizeof(val));
val[0]++;
sleep(1);
}
}
1. start tcp_server
2. start tcp_client
3. kill tcp_server
The problem can be reproduced easily.
