Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-07 Thread Eric Dumazet
On Thu, Jan 7, 2016 at 7:04 AM, Konstantin Khlebnikov wrote: > On Thu, Jan 7, 2016 at 2:59 PM, Eric Dumazet wrote: >> On Thu, Jan 7, 2016 at 6:38 AM, Konstantin Khlebnikov >> wrote: >>> >>> Also I've found strange thing: reason of expanding skb->cb from 40 to >>> 48 bypes in 2006 >>> 3e3850e989

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-07 Thread Eric Dumazet
On Thu, Jan 7, 2016 at 6:38 AM, Konstantin Khlebnikov wrote: > > Also I've found strange thing: reason of expanding skb->cb from 40 to > 48 bypes in 2006 > 3e3850e989c5d2eb1aab6f0fd9257759f0f4cbc6 was that struct inet6_skb_parm does > not fit. But it's is only 24 bytes. Does some arches add pad af

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-07 Thread Konstantin Khlebnikov
On Thu, Jan 7, 2016 at 2:00 PM, Konstantin Khlebnikov wrote: > On Thu, Jan 7, 2016 at 2:49 AM, Florian Westphal wrote: >> Florian Westphal wrote: >>> Thadeu Lima de Souza Cascardo wrote: >>> > On Wed, Jan 06, 2016 at 11:11:41PM +0300, Konstantin Khlebnikov wrote: >> >> [ skb_gso_segment uses sk

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-06 Thread Florian Westphal
Florian Westphal wrote: > Thadeu Lima de Souza Cascardo wrote: > > On Wed, Jan 06, 2016 at 11:11:41PM +0300, Konstantin Khlebnikov wrote: [ skb_gso_segment uses skb->cb[], causes oops if ip_fragment is invoked on segmented skbs ] > > I have hit this as well, this fixes it for me on an older k

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-06 Thread Florian Westphal
Thadeu Lima de Souza Cascardo wrote: > On Wed, Jan 06, 2016 at 11:11:41PM +0300, Konstantin Khlebnikov wrote: > > On Wed, Jan 6, 2016 at 10:59 PM, Cong Wang wrote: > > > On Wed, Jan 6, 2016 at 11:15 AM, Konstantin Khlebnikov > > > wrote: > > >> Looks like this happens because ip_options_fragmen

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-06 Thread Thadeu Lima de Souza Cascardo
On Wed, Jan 06, 2016 at 11:11:41PM +0300, Konstantin Khlebnikov wrote: > On Wed, Jan 6, 2016 at 10:59 PM, Cong Wang wrote: > > On Wed, Jan 6, 2016 at 11:15 AM, Konstantin Khlebnikov > > wrote: > >> Looks like this happens because ip_options_fragment() relies on > >> correct ip options length in

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-06 Thread Konstantin Khlebnikov
On Wed, Jan 6, 2016 at 10:59 PM, Cong Wang wrote: > On Wed, Jan 6, 2016 at 11:15 AM, Konstantin Khlebnikov > wrote: >> Looks like this happens because ip_options_fragment() relies on >> correct ip options length in ip control block in skb. But in >> ip_finish_output_gso() control block in segmen

Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation

2016-01-06 Thread Cong Wang
On Wed, Jan 6, 2016 at 11:15 AM, Konstantin Khlebnikov wrote: > Looks like this happens because ip_options_fragment() relies on > correct ip options length in ip control block in skb. But in > ip_finish_output_gso() control block in segments is reused by > skb_gso_segment(). following ip_fragment(