Commit db4192a7 authored by Cong Wang's avatar Cong Wang Committed by Paolo Abeni

tcp: read multiple skbs in tcp_read_skb()

Before we switched to ->read_skb(), ->read_sock() was passed with
desc.count=1, which technically indicates we only read one skb per
->sk_data_ready() call. However, for TCP, this is not true.

TCP at least has sk_rcvlowat which intentionally holds skb's in
receive queue until this watermark is reached. This means when
->sk_data_ready() is invoked there could be multiple skb's in the
queue, therefore we have to read multiple skbs in tcp_read_skb()
instead of one.

Fixes: 965b57b4 ("net: Introduce a new proto_ops ->read_skb()")
Reported-by: default avatarPeilin Ye <peilin.ye@bytedance.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: default avatarCong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/r/20220912173553.235838-1-xiyou.wangcong@gmail.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 90fdd1c1
...@@ -1761,19 +1761,28 @@ int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor) ...@@ -1761,19 +1761,28 @@ int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor)
if (sk->sk_state == TCP_LISTEN) if (sk->sk_state == TCP_LISTEN)
return -ENOTCONN; return -ENOTCONN;
skb = tcp_recv_skb(sk, seq, &offset); while ((skb = tcp_recv_skb(sk, seq, &offset)) != NULL) {
if (!skb) u8 tcp_flags;
return 0; int used;
__skb_unlink(skb, &sk->sk_receive_queue); __skb_unlink(skb, &sk->sk_receive_queue);
WARN_ON_ONCE(!skb_set_owner_sk_safe(skb, sk)); WARN_ON_ONCE(!skb_set_owner_sk_safe(skb, sk));
copied = recv_actor(sk, skb); tcp_flags = TCP_SKB_CB(skb)->tcp_flags;
if (copied >= 0) { used = recv_actor(sk, skb);
seq += copied; consume_skb(skb);
if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) if (used < 0) {
if (!copied)
copied = used;
break;
}
seq += used;
copied += used;
if (tcp_flags & TCPHDR_FIN) {
++seq; ++seq;
break;
}
} }
consume_skb(skb);
WRITE_ONCE(tp->copied_seq, seq); WRITE_ONCE(tp->copied_seq, seq);
tcp_rcv_space_adjust(sk); tcp_rcv_space_adjust(sk);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment