forked from luck/tmp_suning_uos_patched
333f796235
Until now, the requests sent to topology server are queued to a workqueue by the generic server framework. These messages are processed by worker threads and trigger the registered callbacks. To reduce latency on uniprocessor systems, explicit rescheduling is performed using cond_resched() after MAX_RECV_MSG_COUNT(25) messages. This implementation on SMP systems leads to an subscriber refcnt error as described below: When a worker thread yields by calling cond_resched() in a SMP system, a new worker is created on another CPU to process the pending workitem. Sometimes the sleeping thread wakes up before the new thread finishes execution. This breaks the assumption on ordering and being single threaded. The fault is more frequent when MAX_RECV_MSG_COUNT is lowered. If the first thread was processing subscription create and the second thread processing close(), the close request will free the subscriber and the create request oops as follows: [31.224137] WARNING: CPU: 2 PID: 266 at include/linux/kref.h:46 tipc_subscrb_rcv_cb+0x317/0x380 [tipc] [31.228143] CPU: 2 PID: 266 Comm: kworker/u8:1 Not tainted 4.5.0+ #97 [31.228377] Workqueue: tipc_rcv tipc_recv_work [tipc] [...] [31.228377] Call Trace: [31.228377] [<ffffffff812fbb6b>] dump_stack+0x4d/0x72 [31.228377] [<ffffffff8105a311>] __warn+0xd1/0xf0 [31.228377] [<ffffffff8105a3fd>] warn_slowpath_null+0x1d/0x20 [31.228377] [<ffffffffa0098067>] tipc_subscrb_rcv_cb+0x317/0x380 [tipc] [31.228377] [<ffffffffa00a4984>] tipc_receive_from_sock+0xd4/0x130 [tipc] [31.228377] [<ffffffffa00a439b>] tipc_recv_work+0x2b/0x50 [tipc] [31.228377] [<ffffffff81071925>] process_one_work+0x145/0x3d0 [31.246554] ---[ end trace c3882c9baa05a4fd ]--- [31.248327] BUG: spinlock bad magic on CPU#2, kworker/u8:1/266 [31.249119] BUG: unable to handle kernel NULL pointer dereference at 0000000000000428 [31.249323] IP: [<ffffffff81099d0c>] spin_dump+0x5c/0xe0 [31.249323] PGD 0 [31.249323] Oops: 0000 [#1] SMP In this commit, we - rename tipc_conn_shutdown() to tipc_conn_release(). - move connection release callback execution from tipc_close_conn() to a new function tipc_sock_release(), which is executed before we free the connection. Thus we release the subscriber during connection release procedure rather than connection shutdown procedure. Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
98 lines
3.6 KiB
C
98 lines
3.6 KiB
C
/*
|
|
* net/tipc/server.h: Include file for TIPC server code
|
|
*
|
|
* Copyright (c) 2012-2013, Wind River Systems
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the names of the copyright holders nor the names of its
|
|
* contributors may be used to endorse or promote products derived from
|
|
* this software without specific prior written permission.
|
|
*
|
|
* Alternatively, this software may be distributed under the terms of the
|
|
* GNU General Public License ("GPL") version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
|
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
|
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
* POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifndef _TIPC_SERVER_H
|
|
#define _TIPC_SERVER_H
|
|
|
|
#include <linux/idr.h>
|
|
#include <linux/tipc.h>
|
|
#include <net/net_namespace.h>
|
|
|
|
#define TIPC_SERVER_NAME_LEN 32
|
|
|
|
/**
|
|
* struct tipc_server - TIPC server structure
|
|
* @conn_idr: identifier set of connection
|
|
* @idr_lock: protect the connection identifier set
|
|
* @idr_in_use: amount of allocated identifier entry
|
|
* @net: network namspace instance
|
|
* @rcvbuf_cache: memory cache of server receive buffer
|
|
* @rcv_wq: receive workqueue
|
|
* @send_wq: send workqueue
|
|
* @max_rcvbuf_size: maximum permitted receive message length
|
|
* @tipc_conn_new: callback will be called when new connection is incoming
|
|
* @tipc_conn_release: callback will be called before releasing the connection
|
|
* @tipc_conn_recvmsg: callback will be called when message arrives
|
|
* @saddr: TIPC server address
|
|
* @name: server name
|
|
* @imp: message importance
|
|
* @type: socket type
|
|
*/
|
|
struct tipc_server {
|
|
struct idr conn_idr;
|
|
spinlock_t idr_lock;
|
|
int idr_in_use;
|
|
struct net *net;
|
|
struct kmem_cache *rcvbuf_cache;
|
|
struct workqueue_struct *rcv_wq;
|
|
struct workqueue_struct *send_wq;
|
|
int max_rcvbuf_size;
|
|
void *(*tipc_conn_new)(int conid);
|
|
void (*tipc_conn_release)(int conid, void *usr_data);
|
|
void (*tipc_conn_recvmsg)(struct net *net, int conid,
|
|
struct sockaddr_tipc *addr, void *usr_data,
|
|
void *buf, size_t len);
|
|
struct sockaddr_tipc *saddr;
|
|
char name[TIPC_SERVER_NAME_LEN];
|
|
int imp;
|
|
int type;
|
|
};
|
|
|
|
int tipc_conn_sendmsg(struct tipc_server *s, int conid,
|
|
struct sockaddr_tipc *addr, void *data, size_t len);
|
|
|
|
/**
|
|
* tipc_conn_terminate - terminate connection with server
|
|
*
|
|
* Note: Must call it in process context since it might sleep
|
|
*/
|
|
void tipc_conn_terminate(struct tipc_server *s, int conid);
|
|
|
|
int tipc_server_start(struct tipc_server *s);
|
|
|
|
void tipc_server_stop(struct tipc_server *s);
|
|
|
|
#endif
|