diff mbox

[PANIC] lro + iscsi or lro + skb text search causes panic

Message ID 20090122232131.GA22771@gondor.apana.org.au
State Changes Requested, archived
Delegated to: David Miller
Headers show

Commit Message

Herbert Xu Jan. 22, 2009, 11:21 p.m. UTC
On Thu, Jan 22, 2009 at 12:55:21PM -0800, Brandeburg, Jesse wrote:
> I've filed this bugzilla a while ago.
> http://bugzilla.kernel.org/show_bug.cgi?id=11804
> now other customers are becoming interested as well

Does this patch help?

net: Fix frag_list handling in skb_seq_read

The frag_list handling was broken ini skb_seq_read:

1) We didn't add the stepped offset when looking at the head
are of fragments other than the first.

2) The frag index wasn't reset.

This patch fixes both issues.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,

Comments

Jesse Brandeburg Jan. 22, 2009, 11:45 p.m. UTC | #1
Herbert Xu wrote:
> On Thu, Jan 22, 2009 at 12:55:21PM -0800, Brandeburg, Jesse wrote:
>> I've filed this bugzilla a while ago.
>> http://bugzilla.kernel.org/show_bug.cgi?id=11804
>> now other customers are becoming interested as well
> 
> Does this patch help?
> 
> net: Fix frag_list handling in skb_seq_read
> 
> The frag_list handling was broken ini skb_seq_read:
> 
> 1) We didn't add the stepped offset when looking at the head
> are of fragments other than the first.
> 
> 2) The frag index wasn't reset.
> 
> This patch fixes both issues.
> 
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Herbert, thanks! the patch looks promsing, but we have to setup the repro again.
I'll have a tester take a look at it tomorrow or Monday, and let you know then.

Thanks!
  Jesse--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Mike Christie Jan. 23, 2009, 12:04 a.m. UTC | #2
Herbert Xu wrote:
> On Thu, Jan 22, 2009 at 12:55:21PM -0800, Brandeburg, Jesse wrote:
>> I've filed this bugzilla a while ago.
>> http://bugzilla.kernel.org/show_bug.cgi?id=11804
>> now other customers are becoming interested as well
> 
> Does this patch help?
> 
> net: Fix frag_list handling in skb_seq_read
> 
> The frag_list handling was broken ini skb_seq_read:
> 
> 1) We didn't add the stepped offset when looking at the head
> are of fragments other than the first.
> 
> 2) The frag index wasn't reset.
> 
> This patch fixes both issues.
> 

Without the patch I do not get the oops Jesse saw. The iscsi driver logs 
in and I do not see a problem until running IO (scsi read commands). The 
iscsi code thinks there is a missing packet at the iscsi level and 
begins recovery at that level.

With the patch running against linus's git tree, my box locks up. You 
cannot ping it. I do not get a oops or anything in the logs, and the 
keyboard does not respond. I will try to get some oops output and more info.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Jan. 26, 2009, 5:32 a.m. UTC | #3
From: Mike Christie <michaelc@cs.wisc.edu>
Date: Thu, 22 Jan 2009 18:04:11 -0600

> With the patch running against linus's git tree, my box locks
> up. You cannot ping it. I do not get a oops or anything in the logs,
> and the keyboard does not respond. I will try to get some oops
> output and more info.

Herbert, any idea offhand?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Mike Christie Jan. 26, 2009, 8:54 p.m. UTC | #4
Mike Christie wrote:
> Herbert Xu wrote:
>> On Thu, Jan 22, 2009 at 12:55:21PM -0800, Brandeburg, Jesse wrote:
>>> I've filed this bugzilla a while ago.
>>> http://bugzilla.kernel.org/show_bug.cgi?id=11804
>>> now other customers are becoming interested as well
>>
>> Does this patch help?
>>
>> net: Fix frag_list handling in skb_seq_read
>>
>> The frag_list handling was broken ini skb_seq_read:
>>
>> 1) We didn't add the stepped offset when looking at the head
>> are of fragments other than the first.
>>
>> 2) The frag index wasn't reset.
>>
>> This patch fixes both issues.
>>
> 
> Without the patch I do not get the oops Jesse saw. The iscsi driver logs 
> in and I do not see a problem until running IO (scsi read commands). The 
> iscsi code thinks there is a missing packet at the iscsi level and 
> begins recovery at that level.
> 
> With the patch running against linus's git tree, my box locks up. You 
> cannot ping it. I do not get a oops or anything in the logs, and the 
> keyboard does not respond. I will try to get some oops output and more 
> info.
>

I am not able to get anything. Box is gone.

Jesse, without the patch you guys were getting an oops trace right? Did 
you get one with Herbert's patch?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d7efaf9..ae03c7f 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2215,7 +2215,7 @@  unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
 		return 0;
 
 next_skb:
-	block_limit = skb_headlen(st->cur_skb);
+	block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
 
 	if (abs_offset < block_limit) {
 		*data = st->cur_skb->data + abs_offset;
@@ -2260,6 +2260,7 @@  next_skb:
 	} else if (st->root_skb == st->cur_skb &&
 		   skb_shinfo(st->root_skb)->frag_list) {
 		st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+		st->frag_idx = 0;
 		goto next_skb;
 	}