Re: kernel panic in skb_copy_bits

[Ben Greear]

On 06/29/2013 09:26 AM, Eric Dumazet wrote:
> On Sat, 2013-06-29 at 09:11 -0700, Ben Greear wrote:
>
> > Do you know if your patch should go in 3.9?
>
> Yes it should.

Ok, I'll add that to my tree.

> > Your test case sounds a bit like what gives us the rare crash in tcp_collapse
> > (we have lots of bouncing wifi interfaces running slow-speed TCP trafic).  But,
> > it takes days for us to hit the problem most of the time.
>
> Well, unfortunately that's a different problem :(

For what it's worth, I added this patch to my tree.  We haven't hit the problem
since, but perhaps on the over-the-weekend run we'll see it.


commit 0286716b36a0e5b82c385052a0971f44bc3c3442
Author: Ben Greear <greearb@xxxxxxxxxxxxxxx>
Date:   Tue Jun 25 15:49:52 2013 -0700

    tcp:  Try to work around crash in tcp_collapse.

    And print out some info about why it crashed.

    Signed-off-by: Ben Greear <greearb@xxxxxxxxxxxxxxx>

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a2f267a..63f7704 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4810,7 +4810,15 @@ restart:
                        int offset = start - TCP_SKB_CB(skb)->seq;
                        int size = TCP_SKB_CB(skb)->end_seq - start;

-                       BUG_ON(offset < 0);
+                       if (WARN_ON(offset < 0)) {
+                               /* We see a crash here (when using BUG_ON) every few days under
+                                * some torture tests.  I'm not sure how to clean this up properly,
+                                * so just return and hope thinks keep muddling through. --Ben
+                                */
+                               printk("offset: %i  start: %i seq: %i size: %i copy: %i\n",
+                                      offset, start, TCP_SKB_CB(skb)->seq, size, copy);
+                               return;
+                       }
                        if (size > 0) {
                                size = min(copy, size);
                                if (skb_copy_bits(skb, offset, skb_put(nskb, size), size))



Thanks,
Ben

--
Ben Greear <greearb@xxxxxxxxxxxxxxx>
Candela Technologies Inc  http://www.candelatech.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/