[BUG] af_packet: tpacket_destruct_skb throws BUG under high tx load
From: Daniel Borkmann <hidden>
Date: 2012-08-06 11:49:40
From: Daniel Borkmann <hidden>
Date: 2012-08-06 11:49:40
Under high tx load from mmap()ed PF_PACKET sockets the statement in tpacket_destruct_skb(): BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING); is being thrown, where __packet_get_status(po, ph) has the value TP_STATUS_SEND_REQUEST instead of TP_STATUS_SENDING. The send(2) system call was invoked with the flag MSG_DONTWAIT. The BUG occurred even with having dev_queue_xmit() returned successfully in tpacket_snd(). By simply removing this BUG statement, the system seemed stable, but this might not be the proper solution. It's reproducible and I tested it on a multi-core system under the latest net/net-next kernel on x86 and x86_64. On my system, this BUG was triggered in the following cases: * Multiple processes allocate and use a TX_RING on one device * A single process allocates a TX_RING on one device and /proc/sys/net/core/wmem_default, /proc/sys/net/core/wmem_max were increased Cheers, Daniel