Commit f278b6d5 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

Revert "tcp: avoid atomic operations on sk->sk_rmem_alloc" 



This reverts commit 0de2a5c4.

I forgot that a TCP socket could receive messages in its error queue.

sock_queue_err_skb() can be called without socket lock being held,
and changes sk->sk_rmem_alloc.

The fact that skbs in error queue are limited by sk->sk_rcvbuf
means that error messages can be dropped if socket receive
queues are full, which is an orthogonal issue.

In future kernels, we could use a separate sk->sk_error_mem_alloc
counter specifically for the error queue.

Fixes: 0de2a5c4 ("tcp: avoid atomic operations on sk->sk_rmem_alloc")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250331075946.31960-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent dd07df9f

include/net/tcp.h

+0 −15
Original line number Diff line number Diff line
@@ -779,7 +779,6 @@ static inline int tcp_bound_to_half_wnd(struct tcp_sock *tp, int pktsize) 


/* tcp.c */

void tcp_get_info(struct sock *, struct tcp_info *);

void tcp_sock_rfree(struct sk_buff *skb);



/* Read 'sendfile()'-style from a TCP socket */

int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
@@ -2899,18 +2898,4 @@ enum skb_drop_reason tcp_inbound_hash(struct sock *sk, 
		const void *saddr, const void *daddr,

		int family, int dif, int sdif);



/* version of skb_set_owner_r() avoiding one atomic_add() */

static inline void tcp_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)

{

	skb_orphan(skb);

	skb->sk = sk;

	skb->destructor = tcp_sock_rfree;



	sock_owned_by_me(sk);

	atomic_set(&sk->sk_rmem_alloc,

		   atomic_read(&sk->sk_rmem_alloc) + skb->truesize);



	sk_forward_alloc_add(sk, -skb->truesize);

}



#endif	/* _TCP_H */

net/ipv4/tcp.c

+2 −16
Original line number Diff line number Diff line
@@ -1525,25 +1525,11 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied) 
	__tcp_cleanup_rbuf(sk, copied);

}



/* private version of sock_rfree() avoiding one atomic_sub() */

void tcp_sock_rfree(struct sk_buff *skb)

{

	struct sock *sk = skb->sk;

	unsigned int len = skb->truesize;



	sock_owned_by_me(sk);

	atomic_set(&sk->sk_rmem_alloc,

		   atomic_read(&sk->sk_rmem_alloc) - len);



	sk_forward_alloc_add(sk, len);

	sk_mem_reclaim(sk);

}



static void tcp_eat_recv_skb(struct sock *sk, struct sk_buff *skb)

{

	__skb_unlink(skb, &sk->sk_receive_queue);

	if (likely(skb->destructor == tcp_sock_rfree)) {

		tcp_sock_rfree(skb);

	if (likely(skb->destructor == sock_rfree)) {

		sock_rfree(skb);

		skb->destructor = NULL;

		skb->sk = NULL;

		return skb_attempt_defer_free(skb);

net/ipv4/tcp_fastopen.c

+1 −1
Original line number Diff line number Diff line
@@ -189,7 +189,7 @@ void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb) 
	tcp_segs_in(tp, skb);

	__skb_pull(skb, tcp_hdrlen(skb));

	sk_forced_mem_schedule(sk, skb->truesize);

	tcp_skb_set_owner_r(skb, sk);

	skb_set_owner_r(skb, sk);



	TCP_SKB_CB(skb)->seq++;

	TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN;

net/ipv4/tcp_input.c

+3 −3
Original line number Diff line number Diff line
@@ -5171,7 +5171,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) 
		if (tcp_is_sack(tp))

			tcp_grow_window(sk, skb, false);

		skb_condense(skb);

		tcp_skb_set_owner_r(skb, sk);

		skb_set_owner_r(skb, sk);

	}

}
@@ -5187,7 +5187,7 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, 
	tcp_rcv_nxt_update(tcp_sk(sk), TCP_SKB_CB(skb)->end_seq);

	if (!eaten) {

		tcp_add_receive_queue(sk, skb);

		tcp_skb_set_owner_r(skb, sk);

		skb_set_owner_r(skb, sk);

	}

	return eaten;

}
@@ -5504,7 +5504,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root, 
			__skb_queue_before(list, skb, nskb);

		else

			__skb_queue_tail(&tmp, nskb); /* defer rbtree insertion */

		tcp_skb_set_owner_r(nskb, sk);

		skb_set_owner_r(nskb, sk);

		mptcp_skb_ext_move(nskb, skb);



		/* Copy data, releasing collapsed skbs. */