Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-09-03 Thread Willem de Bruijn
On Tue, Sep 3, 2019 at 1:03 PM Shmulik Ladkani wrote: > > On Tue, 3 Sep 2019 12:23:54 -0400 > Willem de Bruijn wrote: > > > This is a lot more code change. Especially for stable fixes that need > > to be backported, a smaller patch is preferable. > > Indeed. Thanks for the feedback. > > > My sugg

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-09-03 Thread Shmulik Ladkani
On Tue, 3 Sep 2019 12:23:54 -0400 Willem de Bruijn wrote: > This is a lot more code change. Especially for stable fixes that need > to be backported, a smaller patch is preferable. Indeed. Thanks for the feedback. > My suggestion only tested the first frag_skb length. If a list can be > created

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-09-03 Thread Willem de Bruijn
On Tue, Sep 3, 2019 at 11:52 AM Shmulik Ladkani wrote: > > On Sun, 1 Sep 2019 16:05:48 -0400 > Willem de Bruijn wrote: > > > One quick fix is to disable sg and thus revert to copying in this > > case. Not ideal, but better than a kernel splat: > > > > @@ -3714,6 +3714,9 @@ struct sk_buff *skb_seg

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-09-03 Thread Shmulik Ladkani
On Sun, 1 Sep 2019 16:05:48 -0400 Willem de Bruijn wrote: > One quick fix is to disable sg and thus revert to copying in this > case. Not ideal, but better than a kernel splat: > > @@ -3714,6 +3714,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, > sg = !!(features & NETIF_F_SG

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-09-02 Thread Shmulik Ladkani
On Sun, 1 Sep 2019 16:05:48 -0400 Willem de Bruijn wrote: > One quick fix is to disable sg and thus revert to copying in this > case. Not ideal, but better than a kernel splat: > > @@ -3714,6 +3714,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, > sg = !!(features & NETIF_F_SG

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-09-01 Thread Willem de Bruijn
On Thu, Aug 29, 2019 at 8:22 AM Shmulik Ladkani wrote: > > On Tue, 27 Aug 2019 14:10:35 +0200 > Daniel Borkmann wrote: > > > Given first point above wrt hitting rarely, it would be good to first get a > > better understanding for writing a reproducer. Back then Yonghong added one > > to the BPF k

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-29 Thread Shmulik Ladkani
On Tue, 27 Aug 2019 14:10:35 +0200 Daniel Borkmann wrote: > Given first point above wrt hitting rarely, it would be good to first get a > better understanding for writing a reproducer. Back then Yonghong added one > to the BPF kernel test suite [0], so it would be desirable to extend it for > the

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-27 Thread Shmulik Ladkani
On Tue, 27 Aug 2019 14:10:35 +0200 Daniel Borkmann wrote: > Given first point above wrt hitting rarely, it would be good to first get a > better understanding for writing a reproducer. Back then Yonghong added one > to the BPF kernel test suite [0], so it would be desirable to extend it for > the

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-27 Thread Eric Dumazet
On 8/27/19 1:42 PM, Shmulik Ladkani wrote: > On Mon, 26 Aug 2019 19:47:40 +0200 > Eric Dumazet wrote: > >> On 8/26/19 4:07 PM, Shmulik Ladkani wrote: >>> - ipv4 forwarding to dummy1, where eBPF nat4-to-6 program is attached >>> at TC Egress (calls 'bpf_skb_change_proto()'), then redirect

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-27 Thread Daniel Borkmann
On 8/27/19 1:42 PM, Shmulik Ladkani wrote: [...] - Another thing that puzzles me is that we hit the BUG_ON rather rarely and cannot yet reproduce synthetically. If skb_segment's handling of skbs with a frag_list (that have gso_size mangled) is broken, I'd expect to hit this more often...

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-27 Thread Shmulik Ladkani
On Mon, 26 Aug 2019 19:47:40 +0200 Eric Dumazet wrote: > On 8/26/19 4:07 PM, Shmulik Ladkani wrote: > > - ipv4 forwarding to dummy1, where eBPF nat4-to-6 program is attached > > at TC Egress (calls 'bpf_skb_change_proto()'), then redirect to ingress > > on same device. > > NOTE: 'bp

Re: BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-26 Thread Eric Dumazet
On 8/26/19 4:07 PM, Shmulik Ladkani wrote: > Hi, > > In our production systems, running v4.19.y longterm kernels, we hit a > BUG_ON in 'skb_segment()'. It occurs rarely and although tried, couldn't > synthetically reproduce. > > In v4.19.41 it crashes at net/core/skbuff.c:3711 > >

BUG_ON in skb_segment, after bpf_skb_change_proto was applied

2019-08-26 Thread Shmulik Ladkani
Hi, In our production systems, running v4.19.y longterm kernels, we hit a BUG_ON in 'skb_segment()'. It occurs rarely and although tried, couldn't synthetically reproduce. In v4.19.41 it crashes at net/core/skbuff.c:3711 while (pos < offset + len) { if (i