From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95B7C472530 for ; Fri, 14 Aug 2026 13:30:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714224; cv=none; b=jkNEU0xik8lGZwR5C5sUl9SP+FXWV+zln28mz9+yFWhYf7+OnzBkVuHSrgQw3tE8mHSWCMEXInh73w2vM8YPcLLw/omDL+/L5vpzXSqmsIXke6fdfTB4yB2N9d5PWXxJlYQCTQIRriQeqF7wnNRIv/c9OP5XVEsNoUh5aYMxNfY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714224; c=relaxed/simple; bh=Uh2GB1/qrA73GWb7hvofXqCjGqlqeTl6zZuVZvbQuC4=; h=Date:Message-ID:From:To:Cc:Subject:In-Reply-To:References: Content-Type:MIME-Version; b=plMa9ztsNPu4rh9iukAPiqgCxkbzbXsizUlBQPRS+YvXYtReUSpVtwzSl9X3eP0P5Lh1BZs8rFhuo5d6bcLzSuGrEH+bU4vReROVC9X2lV2wjxBGUtuHYXQRAeNGS1rj8tF1IOIiS74wQZtAmqaxKzRoUpbAsU1B4k6oeUPGHLk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nLpDY5/F; arc=none smtp.client-ip=209.85.221.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nLpDY5/F" Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-47f904e80eeso982509f8f.1 for ; Fri, 14 Aug 2026 06:30:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714221; x=1787319021; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:content-type:references :in-reply-to:subject:cc:to:from:message-id:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=QltvzOeHMR23w+hq5zaVdr4TzSIx2nreQRoyPMgK+L8=; b=nLpDY5/FUzL7sC6Cbby9kojovLsGRD7qZRTQsJe20m1dupi4b2eVPvK5JdPJxCiFXM lx4VdynCNGagGeCttK1XuxSXgbMfIjh2QXrG2oOxX6XoxK5xn/kBhulpSfvhTviHGRrh PUMVGEpr+UmHdQSu34XPZjovsdyrDXLrN3ky3ZkC4LWh5VCdCdyLEQmGGMBwfJW1NGl4 IEOC1zJn1queOG9NFNSSL1sJ9FEDn5wAlPlYhTNbgL20CqfliYk62x07gm6UZHYJ4HhT x4pCNS9VVoYQbcvs3Jil88qNm5VNWyLqhx31Z4Ugaugx/N99yDkByfTZYkY3bkDNVKQS 0BdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714221; x=1787319021; h=mime-version:content-transfer-encoding:content-type:references :in-reply-to:subject:cc:to:from:message-id:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=QltvzOeHMR23w+hq5zaVdr4TzSIx2nreQRoyPMgK+L8=; b=bQ6VGPObiHH37MSK39LyTh4TycpgytADrSwLYMD8Uxi8G9vgOCXxsBuO7aV1IDxPV2 hjpSxRh0KsEMy/6GoyPJPqwAJEawMUl3Y5G5uaJh4jQoe0X8zC/FZTstg7WO/S38GGe7 yRVJjTTqjrCC+/I9REQGju0637Sfkx0BXMCWIRO5HL3ULZdhJVg8kcWsDMR4y8OHyFxC 6d06+egJa6WUFRnX+N2rv9kufASrcldvNqf/WmtixaC3EYiyd1K9BdDTLDEH6/o9DBGK rRPK3aTjiwLg5sp476OVjoQ8J6ZjIpC4WZMHeJeRvs8nParTTEaVH6cXUS/Q0bkkYIlO Z0uQ== X-Forwarded-Encrypted: i=1; AHgh+RrbdXc/Mb4RWNTkaZETkjSeuuWLoBKhXuU4ePWKbVp3HM1I8CLZUIwFgPo5rRUJ69RqTQNV6PzVofA68aw=@vger.kernel.org X-Gm-Message-State: AOJu0YxDp8mkpUqrYL6OHuTCwT5thyzfV63djRS3b+Hpu/oHuuLfheo7 IdedTI405I6TL4G4Qk+++2hjNXwv0/eqwTnkAKIRizgqjBsfy6uUtwft X-Gm-Gg: AR+sD13XfvwKk40qqrFGKS0thg0nEUbSRUv04U7tD/4NF3uFGrseNRIz6kewRQg33VS HSmXKEwSgzplfkKTF70YbwhL+Hh+DXILS6WeuMnmshR9Xdncwpq5wLqLbZmOVvJy1r7KMonLEMT 5W/XOdvjUhQ3jbE3Mlm0BQtUAA98ycv7xS06go2YH5+qwki9BecTEW6Zv0q63QWuvXcfRxlpejD JSJguEjGYmxjrC5d/1qSYT2vIwt3Ffc/NNAXnDZJQlCO1Y6/GTpN6T4joEz/hXYradotKy44AYt YltC1Nui75II00BYq4CdIVhTrTRmUDtV1qKYQRGq8RzJmTpP6XE9mUwx3L6zoX1RGY9Zrfvbwga JqXtxEzdqBRKwJJPZWywJONaKwm7EZfu/j1ILPGKfTM7CZ4HMA3qm4sMjYYNMSaQ8VzSf0X6V9T zWquqco6w8871R2+QTwDuWFZ9KZeM08WFXa6IRYu8+o9uylJ/smNP2tMX+2X6itzR2tNI6a8392 DExC0Zt4eCHiXY= X-Received: by 2002:a05:600c:198d:b0:499:7aa7:eaa7 with SMTP id 5b1f17b1804b1-499879a213dmr70583895e9.15.1786714220681; Fri, 14 Aug 2026 06:30:20 -0700 (PDT) Received: from localhost ([37.30.50.141]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49989ae1ef2sm26281515e9.9.2026.08.14.06.30.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:30:19 -0700 (PDT) Date: Fri, 14 Aug 2026 13:29:59 +0000 Message-ID: <178671419949.2648204.15668657474779239190@gmail.com> From: Bartosz Chronowski To: syzbot Cc: Tung Quang Nguyen , horms@kernel.org, linux-kernel@vger.kernel.org, syzbot@lists.linux.dev, Eric Dumazet , Jon Maloy , Jakub Kicinski , netdev@vger.kernel.org, Paolo Abeni , tipc-discussion@lists.sourceforge.net, syzkaller-bugs@googlegroups.com, syzbot , David S. Miller Subject: Re: [PATCH] tipc: defer local Nagle backlog xmit from receive path In-Reply-To: =?utf-8?q?=3CGV1P189MB1988F6301FA670CA9818F7FCC6DB2=40GV1P189MB?= =?utf-8?q?1988=2EEURP189=2EPROD=2EOUTLOOK=2ECOM=3E?= References: <631b75b4-d1e3-40ea-a129-5ed090f914bf@mail.kernel.org> =?utf-8?q?=3CGV1P189MB1988F6301FA670CA9818F7FCC6DB2=40GV1P189MB1988=2EEURP1?= =?utf-8?q?89=2EPROD=2EOUTLOOK=2ECOM=3E?= X-Kernel-Ph2-Extid: 10a41dc44eef71aa9450 X-Kernel-Ph2-Human-Revision: 2 X-Kernel-Ph2-Patch-SHA256: c82ee5c8d899d19d7675bbc18b1270d670d74fdfb455a3b39c182d07fbeb4958 X-Kernel-Ph2-Fingerprint: f2657cd81fedfff2f7fc01adc5a1ff647de95ce6d4031968585e19411fffcc1c Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 1590cf0329716306e948a8fc29f1d3ee87d3989f diff --git a/net/tipc/socket.c b/net/tipc/socket.c index e564341e0216d35ae4fe539576b6e0be89b84ddb..0bf259672827db095046cda5646df047002dd663 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -94,6 +94,7 @@ struct sockaddr_pair { * @peer: 'connected' peer for dgram/rdm * @node: hash table node * @mc_method: cookie for use between socket and broadcast layer + * @backlog_work: processes receive backlog under socket ownership * @rcu: rcu struct for tipc_sock * @group: TIPC communications group * @oneway: message count in one direction (FIXME) @@ -128,6 +129,7 @@ struct tipc_sock { struct sockaddr_tipc peer; struct rhash_head node; struct tipc_mc_method mc_method; + struct work_struct backlog_work; struct rcu_head rcu; struct tipc_group *group; u32 oneway; @@ -143,6 +145,7 @@ struct tipc_sock { }; static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb); +static void tipc_sk_backlog_work(struct work_struct *work); static void tipc_data_ready(struct sock *sk); static void tipc_write_space(struct sock *sk); static void tipc_sock_destruct(struct sock *sk); @@ -520,6 +523,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, sk->sk_data_ready = tipc_data_ready; sk->sk_write_space = tipc_write_space; sk->sk_destruct = tipc_sock_destruct; + INIT_WORK(&tsk->backlog_work, tipc_sk_backlog_work); tsk->conn_timeout = CONN_TIMEOUT_DEFAULT; tsk->group_is_open = true; atomic_set(&tsk->dupl_rcvcnt, 0); @@ -2417,6 +2421,17 @@ static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb) return 0; } +static void tipc_sk_backlog_work(struct work_struct *work) +{ + struct tipc_sock *tsk = container_of(work, struct tipc_sock, + backlog_work); + struct sock *sk = &tsk->sk; + + lock_sock(sk); + release_sock(sk); + sock_put(sk); +} + /** * tipc_sk_enqueue - extract all buffers with destination 'dport' from * inputq and try adding them to socket or backlog queue @@ -2434,18 +2449,30 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, struct sk_buff *skb; unsigned int lim; atomic_t *dcnt; + bool deferred = false; + bool owned; + bool local_backlog; u32 onode; while (skb_queue_len(inputq)) { if (unlikely(time_after_eq(jiffies, time_limit))) - return; + break; skb = tipc_skb_dequeue(inputq, dport); if (unlikely(!skb)) - return; + break; - /* Add message directly to receive queue if possible */ - if (!sock_owned_by_user(sk)) { + /* + * A local Nagle backlog may loop back into this socket while its + * spinlock is held. Queue the triggering input for processing under + * socket ownership, which keeps a concurrent sender from overtaking + * the already queued output. + */ + owned = sock_owned_by_user(sk); + local_backlog = !skb_queue_empty(&sk->sk_write_queue) && + in_own_node(sock_net(sk), + tsk_peer_node(tipc_sk(sk))); + if (!owned && !local_backlog) { tipc_sk_filter_rcv(sk, skb, xmitq); continue; } @@ -2456,6 +2483,7 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, atomic_set(dcnt, 0); lim = rcvbuf_limit(sk, skb) + atomic_read(dcnt); if (likely(!sk_add_backlog(sk, skb, lim))) { + deferred |= !owned; trace_tipc_sk_overlimit1(sk, skb, TIPC_DUMP_SK_BKLGQ, "bklg & rcvq >90% allocated!"); continue; @@ -2472,6 +2500,12 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, } break; } + + if (deferred) { + sock_hold(sk); + if (!schedule_work(&tipc_sk(sk)->backlog_work)) + sock_put(sk); + } } /**