linux-kernel - Re: kernel panic in skb_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51CF0BFA.4080308@candelatech.com>
Date:	Sat, 29 Jun 2013 09:31:54 -0700
From:	Ben Greear <greearb@...delatech.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	Joe Jin <joe.jin@...cle.com>,
	Frank Blaschka <frank.blaschka@...ibm.com>,
	"David S. Miller" <davem@...emloft.net>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"zheng.x.li@...cle.com" <zheng.x.li@...cle.com>,
	Xen Devel <xen-devel@...ts.xen.org>,
	Ian Campbell <Ian.Campbell@...rix.com>,
	Jan Beulich <JBeulich@...e.com>,
	Stefano Stabellini <stefano.stabellini@...citrix.com>
Subject: Re: kernel panic in skb_copy_bits

On 06/29/2013 09:26 AM, Eric Dumazet wrote:
> On Sat, 2013-06-29 at 09:11 -0700, Ben Greear wrote:
>
>> Do you know if your patch should go in 3.9?
>>
>
> Yes it should.

Ok, I'll add that to my tree.

>> Your test case sounds a bit like what gives us the rare crash in tcp_collapse
>> (we have lots of bouncing wifi interfaces running slow-speed TCP trafic).  But,
>> it takes days for us to hit the problem most of the time.
>
> Well, unfortunately that's a different problem :(

For what it's worth, I added this patch to my tree.  We haven't hit the problem
since, but perhaps on the over-the-weekend run we'll see it.


commit 0286716b36a0e5b82c385052a0971f44bc3c3442
Author: Ben Greear <greearb@...delatech.com>
Date:   Tue Jun 25 15:49:52 2013 -0700

     tcp:  Try to work around crash in tcp_collapse.

     And print out some info about why it crashed.

     Signed-off-by: Ben Greear <greearb@...delatech.com>

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a2f267a..63f7704 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4810,7 +4810,15 @@ restart:
                         int offset = start - TCP_SKB_CB(skb)->seq;
                         int size = TCP_SKB_CB(skb)->end_seq - start;

-                       BUG_ON(offset < 0);
+                       if (WARN_ON(offset < 0)) {
+                               /* We see a crash here (when using BUG_ON) every few days under
+                                * some torture tests.  I'm not sure how to clean this up properly,
+                                * so just return and hope thinks keep muddling through. --Ben
+                                */
+                               printk("offset: %i  start: %i seq: %i size: %i copy: %i\n",
+                                      offset, start, TCP_SKB_CB(skb)->seq, size, copy);
+                               return;
+                       }
                         if (size > 0) {
                                 size = min(copy, size);
                                 if (skb_copy_bits(skb, offset, skb_put(nskb, size), size))



Thanks,
Ben

-- 
Ben Greear <greearb@...delatech.com>
Candela Technologies Inc  http://www.candelatech.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/