Hello Or,
We have seen skb_under_panic() in our test enviornment as well. It's
easy reproduce this with tcpdump on and off.
thanks
Shirley
On Thu, 2008-04-24 at 14:11 +0300, Or Gerlitz wrote:
> > https://bugs.openfabrics.org/show_bug.cgi?id=989
> > --- Comment #13 from [EMAIL PROTECTED] 2008-04-23 13:23 ---
> > I think I found the problem and have a fix.
> >
> > In ipoib_cm_handle_rx_wc(), if the byte_len is < SKB_TSHOLD, a new sk_buff
> > is allocated. The sk_buff's mac.raw is not initialized. It sends the
> > packet
> > up the stack to netif_receive_skb(). In netif_receive_skb(), skb->mac_len
> > is computed by subtracting mac.raw from nh.raw. Since mac.raw was not
> > initialized, we get a very large number. It eventually leads to a panic in
> > skb_under_panic.
> >
> > The diff of the fix:
> > drivers/infiniband/ulp/ipoib/ipoib_cm.c.pre_kris
> > drivers/infiniband/ulp/ipoib/ipoib_cm.c
> > *** drivers/infiniband/ulp/ipoib/ipoib_cm.c.pre_kris2008-04-23
> > 16:05:26.0 -0400
> > --- drivers/infiniband/ulp/ipoib/ipoib_cm.c 2008-04-23
> > 15:16:23.0-0400
> > ***
> > *** 622,627
> > --- 622,628
> > skb_copy_from_linear_data_offset(skb,
> > IPOIB_ENCAP_LEN,
> > small_skb->data,
> > dlen);
> > skb_put(small_skb, dlen);
> > + skb_reset_mac_header(small_skb);
> > skb = small_skb;
> > goto copied;
> > }
> Hi Kris,
>
> Good catch. This code does not exist in the mainline kernel and was
> added through the ofed 1.3 (non) process, see the patch below. Does this
> bug hits you for --every-- small packet received with connected mode? if
> not, can you explain why?
>
> The patch for itself as provided by the ofed sources
> (kernel_patches/fixes/ipoib_0320_small_skb_copy.patch) is event not
> documented, I took the change log from the git used to store it. This not
> reviewed and not documented patch which has a bug who could have been found
> if reviewed is yet another good example why code should not be added through
> ofed but rather through the mainline cycle, etc, oh well.
>
> Or.
> > commit 92557c139fd8329daf1a1bf8beeaa6ae940b055a
> > Author: Eli Cohen <[EMAIL PROTECTED](none)>
> > Date: Mon Feb 18 21:56:03 2008 +0200
> >
> > IB/ipoib: copy small SKBs in CM mode
> >
> > CM mode handling of received packets involves iterating trough the
> > fragments.
> > This is time consuming and in case of small packets it is better to
> > allocate
> > a new small skb and copy the data and pass this smaller SKB up to the
> > IP stack.
> >
> > Signed-off-by: Eli Cohen <[EMAIL PROTECTED]>
> >
> > Index: ofa_1_3_dev_kernel/drivers/infiniband/ulp/ipoib/ipoib.h
> > ===
> > --- ofa_1_3_dev_kernel.orig/drivers/infiniband/ulp/ipoib/ipoib.h
> > 2008-02-18 19:23:23.0 +0200
> > +++ ofa_1_3_dev_kernel/drivers/infiniband/ulp/ipoib/ipoib.h 2008-02-18
> > 22:20:48.0 +0200
> > @@ -99,6 +99,8 @@ enum {
> > MAX_SEND_CQE = 16,
> > UD_POST_RCV_COUNT = 16,
> > CM_POST_SRQ_COUNT = 16,
> > +
> > + SKB_TSHOLD= 256,
> > };
> >
> > #defineIPOIB_OP_RECV (1ul << 31)
> > Index: ofa_1_3_dev_kernel/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> > ===
> > --- ofa_1_3_dev_kernel.orig/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> > 2008-02-18 19:23:23.0 +0200
> > +++ ofa_1_3_dev_kernel/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> > 2008-02-18 22:21:01.0 +0200
> > @@ -554,6 +554,7 @@ void ipoib_cm_handle_rx_wc(struct net_de
> > u64 mapping[IPOIB_CM_RX_SG];
> > int frags;
> > int has_srq;
> > + struct sk_buff *small_skb;
> >
> > ipoib_dbg_data(priv, "cm recv completion: id %d, status: %d\n",
> >wr_id, wc->status);
> > @@ -608,6 +609,20 @@ void ipoib_cm_handle_rx_wc(struct net_de
> > }
> > }
> >
> > + if (wc->byte_len < SKB_TSHOLD) {
> > + int dlen = wc->byte_len - IPOIB_ENCAP_LEN;
> > +
> > + small_skb = dev_alloc_skb(dlen);
> > + if (small_skb) {
> > + small_skb->protocol = ((struct ipoib_header
> > *)skb->data)->proto;
> > + skb_copy_from_linear_data_offset(skb, IPOIB_ENCAP_LEN,
> > +small_skb->data, dlen);
> > + skb_put(small_skb, dlen);
> > + skb = small_skb;
> > + goto copied;
> > + }
> > + }
> > +
> > frags = PAGE_ALIGN(wc->byte_len - min(wc->byte_len,
> > (unsigned)IPOIB_CM_HEAD_SIZE)) /
> > PAGE_SIZE;
> >
> > @@ -634,6 +649,7 @@ void ipoib_cm_handle_rx_wc(struct
