soreceive_stream: mbuf leak if called with mp0 and MSG_WAITALL
Mikolaj Golub
trociny at freebsd.org
Mon Sep 5 19:58:56 UTC 2011
On Sun, 04 Sep 2011 12:30:53 +0300 Mikolaj Golub wrote:
MG> Apparently soreceive_stream() has an issue if it is called to receive data as a
MG> mbuf chain (by supplying an non zero mbuf **mp0) and with MSG_WAITALL set.
MG> I ran into this issue with smbfs, which uses soreceive() exactly in this way
MG> (see netsmb/smb_trantcp.c:nbssn_recv()).
Stressing smbfs a little I also observed the following soreceive_stream()
related panic:
#9 0x80a28c80 in panic (fmt=0x80f4b4a4 "sbappendstream 1")
at /usr/src/sys/kern/kern_shutdown.c:606
#10 0x80a9746b in sbappendstream_locked (sb=0x8bff1874, m=0x8885a600)
at /usr/src/sys/kern/uipc_sockbuf.c:527
#11 0x80bcef62 in tcp_do_segment (m=0x8885a600, th=0x8885a674, so=0x8bff1820, tp=0x8bb4f560,
drop_hdrlen=52, tlen=51, iptos=0 '\0', ti_locked=1)
at /usr/src/sys/netinet/tcp_input.c:2854
#12 0x80bd091d in tcp_input (m=0x8885a600, off0=20) at /usr/src/sys/netinet/tcp_input.c:1382
#13 0x80b5b4fe in ip_input (m=0x8885a600) at /usr/src/sys/netinet/ip_input.c:765
#14 0x80af504b in swi_net (arg=0x81825880) at /usr/src/sys/net/netisr.c:806
#15 0x809fd535 in intr_event_execute_handlers (p=0x86ddc588, ie=0x86d37200)
at /usr/src/sys/kern/kern_intr.c:1257
#16 0x809fe419 in ithread_loop (arg=0x86d39bb0) at /usr/src/sys/kern/kern_intr.c:1270
#17 0x809fa7a8 in fork_exit (callout=0x809fe370 <ithread_loop>, arg=0x86d39bb0,
frame=0x86926d28) at /usr/src/sys/kern/kern_fork.c:1029
#18 0x80d68914 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:275
(kgdb) fr 10
#10 0x80a9746b in sbappendstream_locked (sb=0x8bff1874, m=0x8885a600)
at /usr/src/sys/kern/uipc_sockbuf.c:527
527 KASSERT(sb->sb_mb == sb->sb_lastrecord,("sbappendstream 1"));
(kgdb) l
522 sbappendstream_locked(struct sockbuf *sb, struct mbuf *m)
523 {
524 SOCKBUF_LOCK_ASSERT(sb);
525
526 KASSERT(m->m_nextpkt == NULL,("sbappendstream 0"));
527 KASSERT(sb->sb_mb == sb->sb_lastrecord,("sbappendstream 1"));
528
529 SBLASTMBUFCHK(sb);
530
531 sbcompress(sb, m, sb->sb_mbtail);
(kgdb) p m
$1 = (struct mbuf *) 0x8885a600
(kgdb) p m->m_hdr.mh_next
$2 = (struct mbuf *) 0x0
(kgdb) p sb->sb_mb
$3 = (struct mbuf *) 0x93965e00
(kgdb) p sb->sb_lastrecord
$4 = (struct mbuf *) 0x88cb0200
(kgdb) p sb
$5 = (struct sockbuf *) 0x8bff1874
This sb belonged to smb_iod_thread which at that time was in
soreceive_stream(), notifying the protocol that buffer had been drained:
#1 0x80d74cb7 in ipi_nmi_handler () at /usr/src/sys/i386/i386/mp_machdep.c:1478
#2 0x80d7f383 in trap (frame=0xdc33ea58) at /usr/src/sys/i386/i386/trap.c:219
#3 0x80d6886c in calltrap () at /usr/src/sys/i386/i386/exception.s:168
#4 0x80a26955 in _rw_wlock_hard (rw=0x8d18fac0, tid=2285360576,
file=0x80f68ceb "/usr/src/sys/netinet/tcp_usrreq.c", line=732) at cpufunc.h:294
#5 0x80a274d6 in _rw_wlock (rw=0x8d18fac0,
file=0x80f68ceb "/usr/src/sys/netinet/tcp_usrreq.c", line=732)
at /usr/src/sys/kern/kern_rwlock.c:240
#6 0x80bdf585 in tcp_usr_rcvd (so=0x8bff1820, flags=64)
at /usr/src/sys/netinet/tcp_usrreq.c:732
#7 0x80a9cf63 in soreceive_stream (so=0x8bff1820, psa=0x0, uio=0xdc33ec10, mp0=0xdc33ec44,
controlp=0x0, flagsp=0xdc33ec40) at /usr/src/sys/kern/uipc_socket.c:2097
#8 0x80a9a6c9 in soreceive (so=0x8bff1820, psa=0x0, uio=0xdc33ec10, mp0=0xdc33ec44,
controlp=0x0, flagsp=0xdc33ec40) at /usr/src/sys/kern/uipc_socket.c:2309
#9 0x91165e14 in nbssn_recv (nbp=0x874a49c0, mpp=0xdc33ec98, lenp=0xdc33ec64,
rpcodep=0xdc33ec6b "", td=0x8837d5c0)
at /usr/src/sys/modules/smbfs/../../netsmb/smb_trantcp.c:378
#10 0x91165fee in smb_nbst_recv (vcp=0x8961ae00, mpp=0xdc33ec98, td=0x8837d5c0)
at /usr/src/sys/modules/smbfs/../../netsmb/smb_trantcp.c:598
#11 0x9116bda1 in smb_iod_recvall (iod=0x88c64980)
at /usr/src/sys/modules/smbfs/../../netsmb/smb_iod.c:305
#12 0x9116c82c in smb_iod_thread (arg=0x88c64980)
at /usr/src/sys/modules/smbfs/../../netsmb/smb_iod.c:645
#13 0x809fa7a8 in fork_exit (callout=0x9116c600 <smb_iod_thread>, arg=0x88c64980,
frame=0xdc33ed28) at /usr/src/sys/kern/kern_fork.c:1029
#14 0x80d68914 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:275
(kgdb) fr 7
#7 0x80a9cf63 in soreceive_stream (so=0x8bff1820, psa=0x0, uio=0xdc33ec10, mp0=0xdc33ec44,
controlp=0x0, flagsp=0xdc33ec40) at /usr/src/sys/kern/uipc_socket.c:2097
2097 (*so->so_proto->pr_usrreqs->pru_rcvd)(so, flags);
(kgdb) l
2092 if ((so->so_proto->pr_flags & PR_WANTRCVD) &&
2093 (((flags & MSG_WAITALL) && uio->uio_resid > 0) ||
2094 !(flags & MSG_SOCALLBCK))) {
2095 SOCKBUF_UNLOCK(sb);
2096 VNET_SO_ASSERT(so);
2097 (*so->so_proto->pr_usrreqs->pru_rcvd)(so, flags);
2098 SOCKBUF_LOCK(sb);
2099 }
2100 }
2101
(kgdb) p sb
$6 = (struct sockbuf *) 0x8bff1874
(kgdb) p uio->uio_resid
$7 = 0
I think that after draining mbufs in the "Dequeue as many mbufs as possible"
part, and if there is still data in the socket buffer, we have to update
sb_lastrecord (as it is done in soreceive_generic). See the attached patch.
--
Mikolaj Golub
-------------- next part --------------
A non-text attachment was scrubbed...
Name: uipc_socket.c.soreceive_stream.2.patch
Type: text/x-patch
Size: 413 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20110905/35540857/uipc_socket.c.soreceive_stream.2.bin
More information about the freebsd-net
mailing list