Fan Du c69736696c inet: fix double request socket freeing ...

Eric Hugne reported following error :

I'm hitting this warning on latest net-next when i try to SSH into a machine
with eth0 added to a bridge (but i think the problem is older than that)

Steps to reproduce:
node2 ~ # brctl addif br0 eth0
[  223.758785] device eth0 entered promiscuous mode
node2 ~ # ip link set br0 up
[  244.503614] br0: port 1(eth0) entered forwarding state
[  244.505108] br0: port 1(eth0) entered forwarding state
node2 ~ # [  251.160159] ------------[ cut here ]------------
[  251.160831] WARNING: CPU: 0 PID: 3 at include/net/request_sock.h:102 tcp_v4_err+0x6b1/0x720()
[  251.162077] Modules linked in:
[  251.162496] CPU: 0 PID: 3 Comm: ksoftirqd/0 Not tainted 4.0.0-rc3+ #18
[  251.163334] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[  251.164078]  ffffffff81a8365c ffff880038a6ba18 ffffffff8162ace4 0000000000009898
[  251.165084]  0000000000000000 ffff880038a6ba58 ffffffff8104da85 ffff88003fa437c0
[  251.166195]  ffff88003fa437c0 ffff88003fa74e00 ffff88003fa43bb8 ffff88003fad99a0
[  251.167203] Call Trace:
[  251.167533]  [<ffffffff8162ace4>] dump_stack+0x45/0x57
[  251.168206]  [<ffffffff8104da85>] warn_slowpath_common+0x85/0xc0
[  251.169239]  [<ffffffff8104db65>] warn_slowpath_null+0x15/0x20
[  251.170271]  [<ffffffff81559d51>] tcp_v4_err+0x6b1/0x720
[  251.171408]  [<ffffffff81630d03>] ? _raw_read_lock_irq+0x3/0x10
[  251.172589]  [<ffffffff81534e20>] ? inet_del_offload+0x40/0x40
[  251.173366]  [<ffffffff81569295>] icmp_socket_deliver+0x65/0xb0
[  251.174134]  [<ffffffff815693a2>] icmp_unreach+0xc2/0x280
[  251.174820]  [<ffffffff8156a82d>] icmp_rcv+0x2bd/0x3a0
[  251.175473]  [<ffffffff81534ea2>] ip_local_deliver_finish+0x82/0x1e0
[  251.176282]  [<ffffffff815354d8>] ip_local_deliver+0x88/0x90
[  251.177004]  [<ffffffff815350f0>] ip_rcv_finish+0xf0/0x310
[  251.177693]  [<ffffffff815357bc>] ip_rcv+0x2dc/0x390
[  251.178336]  [<ffffffff814f5da3>] __netif_receive_skb_core+0x713/0xa20
[  251.179170]  [<ffffffff814f7fca>] __netif_receive_skb+0x1a/0x80
[  251.179922]  [<ffffffff814f97d4>] process_backlog+0x94/0x120
[  251.180639]  [<ffffffff814f9612>] net_rx_action+0x1e2/0x310
[  251.181356]  [<ffffffff81051267>] __do_softirq+0xa7/0x290
[  251.182046]  [<ffffffff81051469>] run_ksoftirqd+0x19/0x30
[  251.182726]  [<ffffffff8106cc23>] smpboot_thread_fn+0x153/0x1d0
[  251.183485]  [<ffffffff8106cad0>] ? SyS_setgroups+0x130/0x130
[  251.184228]  [<ffffffff8106935e>] kthread+0xee/0x110
[  251.184871]  [<ffffffff81069270>] ? kthread_create_on_node+0x1b0/0x1b0
[  251.185690]  [<ffffffff81631108>] ret_from_fork+0x58/0x90
[  251.186385]  [<ffffffff81069270>] ? kthread_create_on_node+0x1b0/0x1b0
[  251.187216] ---[ end trace c947fc7b24e42ea1 ]---
[  259.542268] br0: port 1(eth0) entered forwarding state

Remove the double calls to reqsk_put()

[edumazet] :

I got confused because reqsk_timer_handler() _has_ to call
reqsk_put(req) after calling inet_csk_reqsk_queue_drop(), as
the timer handler holds a reference on req.

Signed-off-by: Fan Du <fan.du@intel.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Erik Hugne <erik.hugne@ericsson.com>
Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer")
Signed-off-by: David S. Miller <davem@davemloft.net>

2015-03-23 21:40:48 -04:00

..

netfilter

netfilter: fix sparse warnings in reject handling

2015-03-10 15:01:32 +01:00

af_inet.c

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

ah4.c

ipsec: Remove obsolete MAX_AH_AUTH_LEN

2014-09-18 10:54:36 +02:00

arp.c

neigh: Factor out ___neigh_lookup_noref

2015-03-04 00:23:23 -05:00

cipso_ipv4.c

cipso: don't use IPCB() to locate the CIPSO IP option

2015-02-11 14:46:37 -05:00

datagram.c

net: Save TX flow hash in sock and set in skbuf on xmit

2014-07-07 21:14:21 -07:00

devinet.c

ipv4, ipv6: kill ip_mc_{join, leave}_group and ipv6_sock_mc_{join, drop}

2015-03-18 22:05:09 -04:00

esp4.c

net: esp: Convert NETDEBUG to pr_info

2014-11-06 15:11:10 -05:00

fib_frontend.c

fib_trie: Avoid NULL pointer if local table is not allocated

2015-03-12 18:26:51 -04:00

fib_lookup.h

ipv4: FIB Local/MAIN table collapse

2015-03-11 16:22:14 -04:00

fib_rules.c

ipv4: FIB Local/MAIN table collapse

2015-03-11 16:22:14 -04:00

fib_semantics.c

net: Kill hold_net release_net

2015-03-12 14:39:40 -04:00

fib_trie.c

fib_trie: Fix regression in handling of inflate/halve failure

2015-03-23 16:58:32 -04:00

fou.c

gue: Use checksum partial with remote checksum offload

2015-02-11 15:12:13 -08:00

geneve.c

openvswitch: Add support for checksums on UDP tunnels.

2015-01-28 23:04:15 -08:00

gre_demux.c

net: Fix GRE RX to use skb_transport_header for GRE header offset

2014-09-08 15:23:05 -07:00

gre_offload.c

gre: Set inner mac header in gro complete

2014-12-05 21:18:34 -08:00

icmp.c

ipv4: icmp: use percpu allocation

2015-01-31 17:48:18 -08:00

igmp.c

ipv4, ipv6: kill ip_mc_{join, leave}_group and ipv6_sock_mc_{join, drop}

2015-03-18 22:05:09 -04:00

inet_connection_sock.c

net: convert syn_wait_lock to a spinlock

2015-03-23 16:52:26 -04:00

inet_diag.c

net: convert syn_wait_lock to a spinlock

2015-03-23 16:52:26 -04:00

inet_fragment.c

net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited

2014-11-11 14:10:31 -05:00

inet_hashtables.c

inet: get rid of last __inet_hash_connect() argument

2015-03-18 22:00:35 -04:00

inet_lro.c

lro: remove dead code

2013-12-29 16:34:25 -05:00

inet_timewait_sock.c

inet: add a schedule point in inet_twsk_purge()

2015-03-18 22:38:13 -04:00

inetpeer.c

inet: remove dead inetpeer sequence code

2014-09-08 16:42:42 -07:00

ip_forward.c

xps: must clear sender_cpu before forwarding

2015-03-11 23:51:18 -04:00

ip_fragment.c

ipv4: ip_check_defrag should not assume that skb_network_offset is zero

2015-03-05 21:43:48 -05:00

ip_gre.c

gre/ipip: use be16 variants of netlink functions

2015-02-08 16:28:06 -08:00

ip_input.c

net: Fix memory leak if TPROXY used with TCP early demux

2014-01-27 16:22:11 -08:00

ip_options.c

ipv4: rename ip_options_echo to __ip_options_echo()

2014-09-28 16:35:42 -04:00

ip_output.c

udp: only allow UFO for packets from SOCK_DGRAM sockets

2015-03-02 22:19:29 -05:00

ip_sockglue.c

ipv4, ipv6: kill ip_mc_{join, leave}_group and ipv6_sock_mc_{join, drop}

2015-03-18 22:05:09 -04:00

ip_tunnel_core.c

ipv4: fix a potential use after free in ip_tunnel_core.c

2014-10-17 23:45:26 -04:00

ip_tunnel.c

tunnels: advertise link netns via netlink

2015-01-19 14:32:03 -05:00

ip_vti.c

tunnels: advertise link netns via netlink

2015-01-19 14:32:03 -05:00

ipcomp.c

ipcomp4: Use the IPsec protocol multiplexer API

2014-02-25 07:04:17 +01:00

ipconfig.c

net: ipv4: handle DSA enabled master network devices

2015-01-19 15:45:10 -05:00

ipip.c

gre/ipip: use be16 variants of netlink functions

2015-02-08 16:28:06 -08:00

ipmr.c

net: Introduce possible_net_t

2015-03-12 14:39:40 -04:00

Kconfig

net: Move fou_build_header into fou.c and refactor

2014-11-05 16:30:02 -05:00

Makefile

net: Add Geneve tunneling protocol driver

2014-10-06 00:32:20 -04:00

netfilter.c

netfilter: remove double colon

2014-02-19 11:41:25 +01:00

ping.c

netns: constify net_hash_mix() and various callers

2015-03-18 22:00:34 -04:00

proc.c

tcp: helpers to mitigate ACK loops by rate-limiting out-of-window dupacks

2015-02-08 01:03:12 -08:00

protocol.c

net: Export inet_offloads and inet6_offloads

2014-09-19 17:15:31 -04:00

raw.c

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

route.c

net: Remove protocol from struct dst_ops

2015-03-09 16:06:10 -04:00

syncookies.c

inet: get rid of central tcp/dccp listener timer

2015-03-20 12:40:25 -04:00

sysctl_net_ipv4.c

ipv4: Create probe timer for tcp PMTU as per RFC4821

2015-03-06 14:57:42 -05:00

tcp_bic.c

tcp: stretch ACK fixes prep

2015-01-28 22:18:37 -08:00

tcp_cong.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-03-20 18:51:09 -04:00

tcp_cubic.c

tcp: restore 1.5x per RTT limit to CUBIC cwnd growth in congestion avoidance

2015-03-11 16:51:51 -04:00

tcp_dctcp.c

net: tcp: add DCTCP congestion control algorithm

2014-09-29 00:13:10 -04:00

tcp_diag.c

inet_diag: add const to inet_diag_req_v2

2015-03-10 13:45:28 -04:00

tcp_fastopen.c

inet: get rid of central tcp/dccp listener timer

2015-03-20 12:40:25 -04:00

tcp_highspeed.c

tcp: whitespace fixes

2014-09-01 18:12:45 -07:00

tcp_htcp.c

tcp: whitespace fixes

2014-09-01 18:12:45 -07:00

tcp_hybla.c

tcp: whitespace fixes

2014-09-01 18:12:45 -07:00

tcp_illinois.c

tcp: whitespace fixes

2014-09-01 18:12:45 -07:00

tcp_input.c

inet: drop prev pointer handling in request sock

2015-03-20 12:40:25 -04:00

tcp_ipv4.c

inet: fix double request socket freeing

2015-03-23 21:40:48 -04:00

tcp_lp.c

tcp: remove in_flight parameter from cong_avoid() methods

2014-05-03 19:23:07 -04:00

tcp_memcontrol.c

memcg: cleanup static keys decrement

2015-02-12 18:54:10 -08:00

tcp_metrics.c

tcp_metrics: fix wrong lockdep annotations

2015-03-16 16:32:23 -04:00

tcp_minisocks.c

inet: get rid of central tcp/dccp listener timer

2015-03-20 12:40:25 -04:00

tcp_offload.c

tcp: cleanup static functions

2015-02-28 16:56:51 -05:00

tcp_output.c

Revert "selinux: add a skb_owned_by() hook"

2015-03-20 21:36:53 -04:00

tcp_probe.c

tcp: whitespace fixes

2014-09-01 18:12:45 -07:00

tcp_scalable.c

tcp: stretch ACK fixes prep

2015-01-28 22:18:37 -08:00

tcp_timer.c

inet: remove sk_listener parameter from syn_ack_timeout()

2015-03-23 16:52:25 -04:00

tcp_vegas.c

tcp: whitespace fixes

2014-09-01 18:12:45 -07:00

tcp_vegas.h

net: ipv4/ipv6: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

tcp_veno.c

tcp: stretch ACK fixes prep

2015-01-28 22:18:37 -08:00

tcp_westwood.c

net: tcp: split ack slow/fast events from cwnd_event

2014-09-29 00:13:10 -04:00

tcp_yeah.c

tcp: stretch ACK fixes prep

2015-01-28 22:18:37 -08:00

tcp.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-03-09 23:38:02 -04:00

tunnel4.c

…

udp_diag.c

inet_diag: add const to inet_diag_req_v2

2015-03-10 13:45:28 -04:00

udp_impl.h

net: Remove iocb argument from sendmsg and recvmsg

2015-03-02 13:06:31 -05:00

udp_offload.c

udp: Set SKB_GSO_UDP_TUNNEL* in UDP GRO path

2015-02-11 15:12:10 -08:00

udp_tunnel.c

udp: Do not require sock in udp_tunnel_xmit_skb

2015-01-24 23:15:40 -08:00

udp.c

netns: constify net_hash_mix() and various callers

2015-03-18 22:00:34 -04:00

udplite.c

net: Eliminate no_check from protosw

2014-05-23 16:28:53 -04:00

xfrm4_input.c

xfrm4: Add IPsec protocol multiplexer

2014-02-25 07:04:16 +01:00

xfrm4_mode_beet.c

ipv4: ERROR: code indent should use tabs where possible

2013-12-26 13:43:21 -05:00

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

inetpeer: get rid of ip_id_count

2014-06-02 11:00:41 -07:00

xfrm4_output.c

xfrm: Fix local error reporting crash with interfamily tunnels

2015-02-09 11:14:17 +01:00

xfrm4_policy.c

net: Remove protocol from struct dst_ops

2015-03-09 16:06:10 -04:00

xfrm4_protocol.c

xfrm4: Remove duplicate semicolon

2014-06-30 07:49:47 +02:00

xfrm4_state.c

inet: make no_pmtu_disc per namespace and kill ipv4_config

2013-12-18 16:58:20 -05:00

xfrm4_tunnel.c

sit: add IPv4 over IPv4 support

2013-05-31 17:19:05 -07:00