Re: [PATCH net 2/7] net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit()
Fixes: e41c7c68ea77 ("ip6erspan: make sure enough headroom at xmit.")
Re: [PATCH net 2/7] net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit()
On Thu, May 17, 2018 at 7:36 AM, Petr Machata wrote: > dev->needed_headroom is not primed until ip6_tnl_xmit(), so it starts > out zero. Thus the call to skb_cow_head() fails to actually make sure > there's enough headroom to push the ERSPAN headers to. That can lead to > the panic cited below. (Reproducer below that). > > Fix by requesting either needed_headroom if already primed, or just the > bare minimum needed for the header otherwise. > > [ 190.703567] kernel BUG at net/core/skbuff.c:104! > [ 190.708384] invalid opcode: [#1] PREEMPT SMP KASAN PTI > [ 190.714007] Modules linked in: act_mirred cls_matchall ip6_gre ip6_tunnel > tunnel6 gre sch_ingress vrf veth x86_pkg_temp_thermal mlx_platform nfsd > e1000e leds_mlxcpld > [ 190.728975] CPU: 1 PID: 959 Comm: kworker/1:2 Not tainted > 4.17.0-rc4-net_master-custom-139 #10 > [ 190.737647] Hardware name: Mellanox Technologies Ltd. > "MSN2410-CB2F"/"SA000874", BIOS 4.6.5 03/08/2016 > [ 190.747006] Workqueue: ipv6_addrconf addrconf_dad_work > [ 190.75] RIP: 0010:skb_panic+0xc3/0x100 > [ 190.756358] RSP: 0018:8801d54072f0 EFLAGS: 00010282 > [ 190.761629] RAX: 0085 RBX: 8801c1a8ecc0 RCX: > > [ 190.768830] RDX: 0085 RSI: dc00 RDI: > ed003aa80e54 > [ 190.776025] RBP: 8801bd1ec5a0 R08: ed003aabce19 R09: > ed003aabce19 > [ 190.783226] R10: 0001 R11: ed003aabce18 R12: > 8801bf695dbe > [ 190.790418] R13: 0084 R14: 06c0 R15: > 8801bf695dc8 > [ 190.797621] FS: () GS:8801d540() > knlGS: > [ 190.805786] CS: 0010 DS: ES: CR0: 80050033 > [ 190.811582] CR2: 55fa929aced0 CR3: 03228004 CR4: > 001606e0 > [ 190.818790] Call Trace: > [ 190.821264] > [ 190.823314] ? ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] > [ 190.828940] ? ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] > [ 190.834562] skb_push+0x78/0x90 > [ 190.837749] ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] > [ 190.843219] ? ip6gre_tunnel_ioctl+0xd90/0xd90 [ip6_gre] > [ 190.848577] ? debug_check_no_locks_freed+0x210/0x210 > [ 190.853679] ? debug_check_no_locks_freed+0x210/0x210 > [ 190.858783] ? print_irqtrace_events+0x120/0x120 > [ 190.863451] ? sched_clock_cpu+0x18/0x210 > [ 190.867496] ? cyc2ns_read_end+0x10/0x10 > [ 190.871474] ? skb_network_protocol+0x76/0x200 > [ 190.875977] dev_hard_start_xmit+0x137/0x770 > [ 190.880317] ? do_raw_spin_trylock+0x6d/0xa0 > [ 190.884624] sch_direct_xmit+0x2ef/0x5d0 > [ 190.888589] ? pfifo_fast_dequeue+0x3fa/0x670 > [ 190.892994] ? pfifo_fast_change_tx_queue_len+0x810/0x810 > [ 190.898455] ? __lock_is_held+0xa0/0x160 > [ 190.902422] __qdisc_run+0x39e/0xfc0 > [ 190.906041] ? _raw_spin_unlock+0x29/0x40 > [ 190.910090] ? pfifo_fast_enqueue+0x24b/0x3e0 > [ 190.914501] ? sch_direct_xmit+0x5d0/0x5d0 > [ 190.918658] ? pfifo_fast_dequeue+0x670/0x670 > [ 190.923047] ? __dev_queue_xmit+0x172/0x1770 > [ 190.927365] ? preempt_count_sub+0xf/0xd0 > [ 190.931421] __dev_queue_xmit+0x410/0x1770 > [ 190.935553] ? ___slab_alloc+0x605/0x930 > [ 190.939524] ? print_irqtrace_events+0x120/0x120 > [ 190.944186] ? memcpy+0x34/0x50 > [ 190.947364] ? netdev_pick_tx+0x1c0/0x1c0 > [ 190.951428] ? __skb_clone+0x2fd/0x3d0 > [ 190.955218] ? __copy_skb_header+0x270/0x270 > [ 190.959537] ? rcu_read_lock_sched_held+0x93/0xa0 > [ 190.964282] ? kmem_cache_alloc+0x344/0x4d0 > [ 190.968520] ? cyc2ns_read_end+0x10/0x10 > [ 190.972495] ? skb_clone+0x123/0x230 > [ 190.976112] ? skb_split+0x820/0x820 > [ 190.979747] ? tcf_mirred+0x554/0x930 [act_mirred] > [ 190.984582] tcf_mirred+0x554/0x930 [act_mirred] > [ 190.989252] ? tcf_mirred_act_wants_ingress.part.2+0x10/0x10 [act_mirred] > [ 190.996109] ? __lock_acquire+0x706/0x26e0 > [ 191.000239] ? sched_clock_cpu+0x18/0x210 > [ 191.004294] tcf_action_exec+0xcf/0x2a0 > [ 191.008179] tcf_classify+0xfa/0x340 > [ 191.011794] __netif_receive_skb_core+0x8e1/0x1c60 > [ 191.016630] ? debug_check_no_locks_freed+0x210/0x210 > [ 191.021732] ? nf_ingress+0x500/0x500 > [ 191.025458] ? process_backlog+0x347/0x4b0 > [ 191.029619] ? print_irqtrace_events+0x120/0x120 > [ 191.034302] ? lock_acquire+0xd8/0x320 > [ 191.038089] ? process_backlog+0x1b6/0x4b0 > [ 191.042246] ? process_backlog+0xc2/0x4b0 > [ 191.046303] process_backlog+0xc2/0x4b0 > [ 191.050189] net_rx_action+0x5cc/0x980 > [ 191.053991] ? napi_complete_done+0x2c0/0x2c0 > [ 191.058386] ? mark_lock+0x13d/0xb40 > [ 191.062001] ? clockevents_program_event+0x6b/0x1d0 > [ 191.066922] ? print_irqtrace_events+0x120/0x120 > [ 191.071593] ? __lock_is_held+0xa0/0x160 > [ 191.075566] __do_softirq+0x1d4/0x9d2 > [ 191.079282] ? ip6_finish_output2+0x524/0x1460 > [ 191.083771] do_softirq_own_stack+0x2a/0x40 > [ 191.087994] > [ 191.090130] do_softirq.part.13+0x38/0x40 > [ 191.09417
[PATCH net 2/7] net: ip6_gre: Fix headroom request in ip6erspan_tunnel_xmit()
dev->needed_headroom is not primed until ip6_tnl_xmit(), so it starts out zero. Thus the call to skb_cow_head() fails to actually make sure there's enough headroom to push the ERSPAN headers to. That can lead to the panic cited below. (Reproducer below that). Fix by requesting either needed_headroom if already primed, or just the bare minimum needed for the header otherwise. [ 190.703567] kernel BUG at net/core/skbuff.c:104! [ 190.708384] invalid opcode: [#1] PREEMPT SMP KASAN PTI [ 190.714007] Modules linked in: act_mirred cls_matchall ip6_gre ip6_tunnel tunnel6 gre sch_ingress vrf veth x86_pkg_temp_thermal mlx_platform nfsd e1000e leds_mlxcpld [ 190.728975] CPU: 1 PID: 959 Comm: kworker/1:2 Not tainted 4.17.0-rc4-net_master-custom-139 #10 [ 190.737647] Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2F"/"SA000874", BIOS 4.6.5 03/08/2016 [ 190.747006] Workqueue: ipv6_addrconf addrconf_dad_work [ 190.75] RIP: 0010:skb_panic+0xc3/0x100 [ 190.756358] RSP: 0018:8801d54072f0 EFLAGS: 00010282 [ 190.761629] RAX: 0085 RBX: 8801c1a8ecc0 RCX: [ 190.768830] RDX: 0085 RSI: dc00 RDI: ed003aa80e54 [ 190.776025] RBP: 8801bd1ec5a0 R08: ed003aabce19 R09: ed003aabce19 [ 190.783226] R10: 0001 R11: ed003aabce18 R12: 8801bf695dbe [ 190.790418] R13: 0084 R14: 06c0 R15: 8801bf695dc8 [ 190.797621] FS: () GS:8801d540() knlGS: [ 190.805786] CS: 0010 DS: ES: CR0: 80050033 [ 190.811582] CR2: 55fa929aced0 CR3: 03228004 CR4: 001606e0 [ 190.818790] Call Trace: [ 190.821264] [ 190.823314] ? ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] [ 190.828940] ? ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] [ 190.834562] skb_push+0x78/0x90 [ 190.837749] ip6erspan_tunnel_xmit+0x5e4/0x1982 [ip6_gre] [ 190.843219] ? ip6gre_tunnel_ioctl+0xd90/0xd90 [ip6_gre] [ 190.848577] ? debug_check_no_locks_freed+0x210/0x210 [ 190.853679] ? debug_check_no_locks_freed+0x210/0x210 [ 190.858783] ? print_irqtrace_events+0x120/0x120 [ 190.863451] ? sched_clock_cpu+0x18/0x210 [ 190.867496] ? cyc2ns_read_end+0x10/0x10 [ 190.871474] ? skb_network_protocol+0x76/0x200 [ 190.875977] dev_hard_start_xmit+0x137/0x770 [ 190.880317] ? do_raw_spin_trylock+0x6d/0xa0 [ 190.884624] sch_direct_xmit+0x2ef/0x5d0 [ 190.888589] ? pfifo_fast_dequeue+0x3fa/0x670 [ 190.892994] ? pfifo_fast_change_tx_queue_len+0x810/0x810 [ 190.898455] ? __lock_is_held+0xa0/0x160 [ 190.902422] __qdisc_run+0x39e/0xfc0 [ 190.906041] ? _raw_spin_unlock+0x29/0x40 [ 190.910090] ? pfifo_fast_enqueue+0x24b/0x3e0 [ 190.914501] ? sch_direct_xmit+0x5d0/0x5d0 [ 190.918658] ? pfifo_fast_dequeue+0x670/0x670 [ 190.923047] ? __dev_queue_xmit+0x172/0x1770 [ 190.927365] ? preempt_count_sub+0xf/0xd0 [ 190.931421] __dev_queue_xmit+0x410/0x1770 [ 190.935553] ? ___slab_alloc+0x605/0x930 [ 190.939524] ? print_irqtrace_events+0x120/0x120 [ 190.944186] ? memcpy+0x34/0x50 [ 190.947364] ? netdev_pick_tx+0x1c0/0x1c0 [ 190.951428] ? __skb_clone+0x2fd/0x3d0 [ 190.955218] ? __copy_skb_header+0x270/0x270 [ 190.959537] ? rcu_read_lock_sched_held+0x93/0xa0 [ 190.964282] ? kmem_cache_alloc+0x344/0x4d0 [ 190.968520] ? cyc2ns_read_end+0x10/0x10 [ 190.972495] ? skb_clone+0x123/0x230 [ 190.976112] ? skb_split+0x820/0x820 [ 190.979747] ? tcf_mirred+0x554/0x930 [act_mirred] [ 190.984582] tcf_mirred+0x554/0x930 [act_mirred] [ 190.989252] ? tcf_mirred_act_wants_ingress.part.2+0x10/0x10 [act_mirred] [ 190.996109] ? __lock_acquire+0x706/0x26e0 [ 191.000239] ? sched_clock_cpu+0x18/0x210 [ 191.004294] tcf_action_exec+0xcf/0x2a0 [ 191.008179] tcf_classify+0xfa/0x340 [ 191.011794] __netif_receive_skb_core+0x8e1/0x1c60 [ 191.016630] ? debug_check_no_locks_freed+0x210/0x210 [ 191.021732] ? nf_ingress+0x500/0x500 [ 191.025458] ? process_backlog+0x347/0x4b0 [ 191.029619] ? print_irqtrace_events+0x120/0x120 [ 191.034302] ? lock_acquire+0xd8/0x320 [ 191.038089] ? process_backlog+0x1b6/0x4b0 [ 191.042246] ? process_backlog+0xc2/0x4b0 [ 191.046303] process_backlog+0xc2/0x4b0 [ 191.050189] net_rx_action+0x5cc/0x980 [ 191.053991] ? napi_complete_done+0x2c0/0x2c0 [ 191.058386] ? mark_lock+0x13d/0xb40 [ 191.062001] ? clockevents_program_event+0x6b/0x1d0 [ 191.066922] ? print_irqtrace_events+0x120/0x120 [ 191.071593] ? __lock_is_held+0xa0/0x160 [ 191.075566] __do_softirq+0x1d4/0x9d2 [ 191.079282] ? ip6_finish_output2+0x524/0x1460 [ 191.083771] do_softirq_own_stack+0x2a/0x40 [ 191.087994] [ 191.090130] do_softirq.part.13+0x38/0x40 [ 191.094178] __local_bh_enable_ip+0x135/0x190 [ 191.098591] ip6_finish_output2+0x54d/0x1460 [ 191.102916] ? ip6_forward_finish+0x2f0/0x2f0 [ 191.107314] ? ip6_mtu+0x3c/0x2c0 [ 191.110674] ? ip6_finish_output+0x2f8/0x650 [ 191.114992] ? ip6_output+0x12a/0x500
