4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Watson davejwatson@fb.com
[ Upstream commit c212d2c7fc4736d49be102fb7a1a545cdc2f1fea ]
It is reported that in some cases, write_space may be called in do_tcp_sendpages, such that we recursively invoke do_tcp_sendpages again:
[ 660.468802] ? do_tcp_sendpages+0x8d/0x580 [ 660.468826] ? tls_push_sg+0x74/0x130 [tls] [ 660.468852] ? tls_push_record+0x24a/0x390 [tls] [ 660.468880] ? tls_write_space+0x6a/0x80 [tls] ...
tls_push_sg already does a loop over all sending sg's, so ignore any tls_write_space notifications until we are done sending. We then have to call the previous write_space to wake up poll() waiters after we are done with the send loop.
Reported-by: Andre Tomt andre@tomt.net Signed-off-by: Dave Watson davejwatson@fb.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/net/tls.h | 1 + net/tls/tls_main.c | 7 +++++++ 2 files changed, 8 insertions(+)
--- a/include/net/tls.h +++ b/include/net/tls.h @@ -102,6 +102,7 @@ struct tls_context { struct scatterlist *partially_sent_record; u16 partially_sent_offset; unsigned long flags; + bool in_tcp_sendpages;
u16 pending_open_record_frags; int (*push_pending_record)(struct sock *sk, int flags); --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -107,6 +107,7 @@ int tls_push_sg(struct sock *sk, size = sg->length - offset; offset += sg->offset;
+ ctx->in_tcp_sendpages = true; while (1) { if (sg_is_last(sg)) sendpage_flags = flags; @@ -141,6 +142,8 @@ retry: }
clear_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags); + ctx->in_tcp_sendpages = false; + ctx->sk_write_space(sk);
return 0; } @@ -210,6 +213,10 @@ static void tls_write_space(struct sock { struct tls_context *ctx = tls_get_ctx(sk);
+ /* We are already sending pages, ignore notification */ + if (ctx->in_tcp_sendpages) + return; + if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) { gfp_t sk_allocation = sk->sk_allocation; int rc;