[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[34-longterm 194/260] net: Fix the condition passed to sk_wait_event()
    From: Nagendra Tomar <>

    commit 482964e56e1320cb7952faa1932d8ecf59c4bf75 upstream.

    This patch fixes the condition (3rd arg) passed to sk_wait_event() in
    sk_stream_wait_memory(). The incorrect check in sk_stream_wait_memory()
    causes the following soft lockup in tcp_sendmsg() when the global tcp
    memory pool has exhausted.

    >>> snip <<<

    localhost kernel: BUG: soft lockup - CPU#3 stuck for 11s! [sshd:6429]
    localhost kernel: CPU 3:
    localhost kernel: RIP: 0010:[sk_stream_wait_memory+0xcd/0x200] [sk_stream_wait_memory+0xcd/0x200] sk_stream_wait_memory+0xcd/0x200
    localhost kernel:
    localhost kernel: Call Trace:
    localhost kernel: [sk_stream_wait_memory+0x1b1/0x200] sk_stream_wait_memory+0x1b1/0x200
    localhost kernel: [<ffffffff802557c0>] autoremove_wake_function+0x0/0x40
    localhost kernel: [ipv6:tcp_sendmsg+0x6e6/0xe90] tcp_sendmsg+0x6e6/0xce0
    localhost kernel: [sock_aio_write+0x126/0x140] sock_aio_write+0x126/0x140
    localhost kernel: [xfs:do_sync_write+0xf1/0x130] do_sync_write+0xf1/0x130
    localhost kernel: [<ffffffff802557c0>] autoremove_wake_function+0x0/0x40
    localhost kernel: [hrtimer_start+0xe3/0x170] hrtimer_start+0xe3/0x170
    localhost kernel: [vfs_write+0x185/0x190] vfs_write+0x185/0x190
    localhost kernel: [sys_write+0x50/0x90] sys_write+0x50/0x90
    localhost kernel: [system_call+0x7e/0x83] system_call+0x7e/0x83

    >>> snip <<<

    What is happening is, that the sk_wait_event() condition passed from
    sk_stream_wait_memory() evaluates to true for the case of tcp global memory
    exhaustion. This is because both sk_stream_memory_free() and vm_wait are true
    which causes sk_wait_event() to *not* call schedule_timeout().
    Hence sk_stream_wait_memory() returns immediately to the caller w/o sleeping.
    This causes the caller to again try allocation, which again fails and again
    calls sk_stream_wait_memory(), and so on.

    [ Bug introduced by commit c1cbe4b7ad0bc4b1d98ea708a3fecb7362aa4088
    ("[NET]: Avoid atomic xchg() for non-error case") -DaveM ]

    Signed-off-by: Nagendra Singh Tomar <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Paul Gortmaker <>
    net/core/stream.c | 8 ++++----
    1 files changed, 4 insertions(+), 4 deletions(-)

    diff --git a/net/core/stream.c b/net/core/stream.c
    index a37debf..e48c85f 100644
    --- a/net/core/stream.c
    +++ b/net/core/stream.c
    @@ -140,10 +140,10 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)

    set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
    - sk_wait_event(sk, &current_timeo, !sk->sk_err &&
    - !(sk->sk_shutdown & SEND_SHUTDOWN) &&
    - sk_stream_memory_free(sk) &&
    - vm_wait);
    + sk_wait_event(sk, &current_timeo, sk->sk_err ||
    + (sk->sk_shutdown & SEND_SHUTDOWN) ||
    + (sk_stream_memory_free(sk) &&
    + !vm_wait));

    if (vm_wait) {

     \ /
      Last update: 2011-01-02 08:43    [W:0.022 / U:9.860 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site