From nobody Tue Jan 16 19:05:16 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TDz3c6y8Xz57qjR; Tue, 16 Jan 2024 19:05:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TDz3c3FFXz54T3; Tue, 16 Jan 2024 19:05:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1705431916; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4gyCtLNi6GYpn3vW2ZN6Ol3C/c+JT7spRexBkOlnP3I=; b=jnRjWIlU9LPAW+71Ei34BRBKBsgIPHz0gkSxACVAe0mo015+ylgC+RPRzS6hQboxyCnzt7 EberhxPtZNwhXXcRDqljGm/s7wZt3ED7EdOGGHNPMFm04AGCPLZz0iOUGfNWmNVxI6if58 1gVl/zDN3qhl1AbpDqyOtCecicHixnzClTX6eMdwzZLEbdxKvii8ib/oiPbRtakaS5s0n1 S1IcZo5BfCDzsy8De7YwiwwV7ex9rnpHlb2/Jz6MzKkAnXnIfokuctRdibD8aneS3wKpMy tKt6zUwyqYX9r9TNFv2PAlODr3OWqtx6J/hX1urOT/4gv8eXnCbY3RfphHNOmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1705431916; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4gyCtLNi6GYpn3vW2ZN6Ol3C/c+JT7spRexBkOlnP3I=; b=e4nXjn6QU42dHja020AuICDnFvxJT4C+C7n0gVhskfFMG725RN2bQDkR5u4RUanTLxZ3/y VBP6AVkVrDA/M+IfAx7N6or/kWfbvX8L352PN5issB+VjqWE/E/eS7J+QQ3VPgahESmsnI YRIKeVSIf+fZ6w6lJ/myfzxF4bjrt2zkJdSNvY1ckP3J/yKDuIWkeOQmu9j7QAYnB3Z6qZ a9752Aarr0OTV8VESDOkoCD5BKOo5YXaspj18A8JOpb4hdPYp9NPc+5VWSQo0UsilM3d1m SOvQaUPls2JfzzQO7gsPqCVcdGrhL706W2ft6iIuHcFqVJ/js983PObTQksmGA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1705431916; a=rsa-sha256; cv=none; b=pZhUmaPVMSQTaHvmmnVzw1CjsffK7r8eOqvot7JUV3REW3pQq7UcHaXFgU7O6D9I7JgrUT fnFFJleC8jATjkiv4Htg6b4oXTItHewjJdQv8gb78MuwCPw49UVnKPxuw0n8NHMiH9jSaK n3fuNZuv3GdrQ4TaYo37yuck8bXx+rUl+5snYpEzD7Abf8yOxqh0BK8ytIN/gcKW/uOLiW V41ERf2fQetIgPx99paRC1v5rx9skOAcllVQG+x/eUOV6v+kmRPPXyrvfdJcRrzQYqmdsB KUMJGt6yfMgCgbKFDyPU+HRI29jc26AjJ9f9B+s5R/9jX2YiKs2UHqIC00RVKw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TDz3c20dzzs8d; Tue, 16 Jan 2024 19:05:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 40GJ5GMN010215; Tue, 16 Jan 2024 19:05:16 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 40GJ5GXY010212; Tue, 16 Jan 2024 19:05:16 GMT (envelope-from git) Date: Tue, 16 Jan 2024 19:05:16 GMT Message-Id: <202401161905.40GJ5GXY010212@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gleb Smirnoff Subject: git: c0303fa84eed - stable/14 - tcp_hpts: let tcp_hpts_init() set a random CPU only once List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c0303fa84eed989ec7ba9aafcb7028bb11c9d6a2 Auto-Submitted: auto-generated The branch stable/14 has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=c0303fa84eed989ec7ba9aafcb7028bb11c9d6a2 commit c0303fa84eed989ec7ba9aafcb7028bb11c9d6a2 Author: Gleb Smirnoff AuthorDate: 2023-12-07 22:41:43 +0000 Commit: Gleb Smirnoff CommitDate: 2024-01-16 18:47:49 +0000 tcp_hpts: let tcp_hpts_init() set a random CPU only once After d2ef52ef3dee the tcp_hpts_init() function can be called multiple times on a tcpcb if it is switched there and back between two TCP stacks. First, this makes existing assertion in tcp_hpts_init() incorrect. Second, it creates possibility to change a randomly set t_hpts_cpu to a different random value, while a tcpcb is already in the HPTS wheel, triggering other assertions later in tcp_hptsi(). The best approach here would be to work on the stacks to really clear a tcpcb out of HPTS wheel in tfb_tcp_fb_fini, draining the IHPTS_MOVING state. But that's pretty intrusive change, so let's just get back to the old logic (pre d2ef52ef3dee) where t_hpts_cpu was set to a random value only once in a CPU lifetime and a newly switched stack inherits t_hpts_cpu from the previous stack. Reviewed by: rrs, tuexen Differential Revision: https://reviews.freebsd.org/D42946 Reported-by: syzbot+fab29fe1ab089c52998d@syzkaller.appspotmail.com Reported-by: syzbot+ca5f2aa0fda15dcfe6d7@syzkaller.appspotmail.com Fixes: 2b3a77467dd3d74a7170f279fb25f9736b46ef8a (cherry picked from commit 3f46be6acadd5d660acde67d9d4c80137f424b70) --- sys/netinet/tcp_hpts.c | 16 ++++++++++++---- sys/netinet/tcp_subr.c | 3 +++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/sys/netinet/tcp_hpts.c b/sys/netinet/tcp_hpts.c index 92b2f69c9e58..e39c2b69ea7e 100644 --- a/sys/netinet/tcp_hpts.c +++ b/sys/netinet/tcp_hpts.c @@ -542,15 +542,23 @@ tcp_hpts_release(struct tcpcb *tp) } /* - * Initialize newborn tcpcb to get ready for use with HPTS. + * Initialize tcpcb to get ready for use with HPTS. We will know which CPU + * is preferred on the first incoming packet. Before that avoid crowding + * a single CPU with newborn connections and use a random one. + * This initialization is normally called on a newborn tcpcb, but potentially + * can be called once again if stack is switched. In that case we inherit CPU + * that the previous stack has set, be it random or not. In extreme cases, + * e.g. syzkaller fuzzing, a tcpcb can already be in HPTS in IHPTS_MOVING state + * and has never received a first packet. */ void tcp_hpts_init(struct tcpcb *tp) { - tp->t_hpts_cpu = hpts_random_cpu(); - tp->t_lro_cpu = HPTS_CPU_NONE; - MPASS(!(tp->t_flags2 & TF2_HPTS_CPU_SET)); + if (__predict_true(tp->t_hpts_cpu == HPTS_CPU_NONE)) { + tp->t_hpts_cpu = hpts_random_cpu(); + MPASS(!(tp->t_flags2 & TF2_HPTS_CPU_SET)); + } } /* diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 4e28f7917bdf..34150707072e 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2276,6 +2276,9 @@ tcp_newtcpcb(struct inpcb *inp) /* All mbuf queue/ack compress flags should be off */ tcp_lro_features_off(tp); + tp->t_hpts_cpu = HPTS_CPU_NONE; + tp->t_lro_cpu = HPTS_CPU_NONE; + callout_init_rw(&tp->t_callout, &inp->inp_lock, CALLOUT_RETURNUNLOCKED); for (int i = 0; i < TT_N; i++) tp->t_timers[i] = SBT_MAX;