Michael S. Tsirkin
2021-Oct-09 09:17 UTC
[PATCH net] virtio-net: fix for skb_over_panic inside big mode
From: Xuan Zhuo <xuanzhuo at linux.alibaba.com> commit 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") accidentally reverted the effect of commit 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") on drivers/net/virtio_net.c As a result, users of crosvm (which is using large packet mode) are experiencing crashes with 5.14-rc1 and above that do not occur with 5.13. Crash trace: [ 61.346677] skbuff: skb_over_panic: text:ffffffff881ae2c7 len:3762 put:3762 head:ffff8a5ec8c22000 data:ffff8a5ec8c22010 tail:0xec2 end:0xec0 dev:<NULL> [ 61.369192] kernel BUG at net/core/skbuff.c:111! [ 61.372840] invalid opcode: 0000 [#1] SMP PTI [ 61.374892] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.14.0-rc1 linux-v5.14-rc1-for-mesa-ci.tar.bz2 #1 [ 61.376450] Hardware name: ChromiumOS crosvm, BIOS 0 .. [ 61.393635] Call Trace: [ 61.394127] <IRQ> [ 61.394488] skb_put.cold+0x10/0x10 [ 61.395095] page_to_skb+0xf7/0x410 [ 61.395689] receive_buf+0x81/0x1660 [ 61.396228] ? netif_receive_skb_list_internal+0x1ad/0x2b0 [ 61.397180] ? napi_gro_flush+0x97/0xe0 [ 61.397896] ? detach_buf_split+0x67/0x120 [ 61.398573] virtnet_poll+0x2cf/0x420 [ 61.399197] __napi_poll+0x25/0x150 [ 61.399764] net_rx_action+0x22f/0x280 [ 61.400394] __do_softirq+0xba/0x257 [ 61.401012] irq_exit_rcu+0x8e/0xb0 [ 61.401618] common_interrupt+0x7b/0xa0 [ 61.402270] </IRQ> See https://lore.kernel.org/r/5edaa2b7c2fe4abd0347b8454b2ac032b6694e2c.camel%40collabora.com for the report. Apply the original 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") again, the original logic still holds: In virtio-net's large packet mode, there is a hole in the space behind buf. hdr_padded_len - hdr_len We must take this into account when calculating tailroom. Cc: Greg KH <gregkh at linuxfoundation.org> Fixes: fb32856b16ad ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom") Fixes: 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") Signed-off-by: Xuan Zhuo <xuanzhuo at linux.alibaba.com> Reported-by: Corentin No?l <corentin.noel at collabora.com> Tested-by: Corentin No?l <corentin.noel at collabora.com> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- David, I think we need this in stable, too. drivers/net/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 096c2ac6b7a6..6b0812f44bbf 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -406,7 +406,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, * add_recvbuf_mergeable() + get_mergeable_buf_len() */ truesize = headroom ? PAGE_SIZE : truesize; - tailroom = truesize - len - headroom; + tailroom = truesize - len - headroom - (hdr_padded_len - hdr_len); buf = p - headroom; len -= hdr_len; -- MST
Xuan Zhuo
2021-Oct-09 09:29 UTC
[PATCH net] virtio-net: fix for skb_over_panic inside big mode
On Sat, 9 Oct 2021 05:17:53 -0400, Michael S. Tsirkin <mst at redhat.com> wrote:> From: Xuan Zhuo <xuanzhuo at linux.alibaba.com> > > commit 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") > accidentally reverted the effect of > commit 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") > on drivers/net/virtio_net.c > > As a result, users of crosvm (which is using large packet mode) > are experiencing crashes with 5.14-rc1 and above that do not > occur with 5.13. > > Crash trace: > > [ 61.346677] skbuff: skb_over_panic: text:ffffffff881ae2c7 len:3762 put:3762 head:ffff8a5ec8c22000 data:ffff8a5ec8c22010 tail:0xec2 end:0xec0 dev:<NULL> > [ 61.369192] kernel BUG at net/core/skbuff.c:111! > [ 61.372840] invalid opcode: 0000 [#1] SMP PTI > [ 61.374892] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.14.0-rc1 linux-v5.14-rc1-for-mesa-ci.tar.bz2 #1 > [ 61.376450] Hardware name: ChromiumOS crosvm, BIOS 0 > > .. > > [ 61.393635] Call Trace: > [ 61.394127] <IRQ> > [ 61.394488] skb_put.cold+0x10/0x10 > [ 61.395095] page_to_skb+0xf7/0x410 > [ 61.395689] receive_buf+0x81/0x1660 > [ 61.396228] ? netif_receive_skb_list_internal+0x1ad/0x2b0 > [ 61.397180] ? napi_gro_flush+0x97/0xe0 > [ 61.397896] ? detach_buf_split+0x67/0x120 > [ 61.398573] virtnet_poll+0x2cf/0x420 > [ 61.399197] __napi_poll+0x25/0x150 > [ 61.399764] net_rx_action+0x22f/0x280 > [ 61.400394] __do_softirq+0xba/0x257 > [ 61.401012] irq_exit_rcu+0x8e/0xb0 > [ 61.401618] common_interrupt+0x7b/0xa0 > [ 61.402270] </IRQ> > > See > https://lore.kernel.org/r/5edaa2b7c2fe4abd0347b8454b2ac032b6694e2c.camel%40collabora.com > for the report. > > Apply the original 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") > again, the original logic still holds: > > In virtio-net's large packet mode, there is a hole in the space behind > buf. > > hdr_padded_len - hdr_len > > We must take this into account when calculating tailroom. > > Cc: Greg KH <gregkh at linuxfoundation.org> > Fixes: fb32856b16ad ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom") > Fixes: 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") > Signed-off-by: Xuan Zhuo <xuanzhuo at linux.alibaba.com> > Reported-by: Corentin No?l <corentin.noel at collabora.com> > Tested-by: Corentin No?l <corentin.noel at collabora.com> > Signed-off-by: Michael S. Tsirkin <mst at redhat.com>LGTM Reviewed-by: Xuan Zhuo <xuanzhuo at linux.alibaba.com>> --- > > David, I think we need this in stable, too. > > drivers/net/virtio_net.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > index 096c2ac6b7a6..6b0812f44bbf 100644 > --- a/drivers/net/virtio_net.c > +++ b/drivers/net/virtio_net.c > @@ -406,7 +406,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, > * add_recvbuf_mergeable() + get_mergeable_buf_len() > */ > truesize = headroom ? PAGE_SIZE : truesize; > - tailroom = truesize - len - headroom; > + tailroom = truesize - len - headroom - (hdr_padded_len - hdr_len); > buf = p - headroom; > > len -= hdr_len; > -- > MST >
Jason Wang
2021-Oct-11 02:04 UTC
[PATCH net] virtio-net: fix for skb_over_panic inside big mode
On Sat, Oct 9, 2021 at 5:18 PM Michael S. Tsirkin <mst at redhat.com> wrote:> > From: Xuan Zhuo <xuanzhuo at linux.alibaba.com> > > commit 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") > accidentally reverted the effect of > commit 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") > on drivers/net/virtio_net.c > > As a result, users of crosvm (which is using large packet mode) > are experiencing crashes with 5.14-rc1 and above that do not > occur with 5.13. > > Crash trace: > > [ 61.346677] skbuff: skb_over_panic: text:ffffffff881ae2c7 len:3762 put:3762 head:ffff8a5ec8c22000 data:ffff8a5ec8c22010 tail:0xec2 end:0xec0 dev:<NULL> > [ 61.369192] kernel BUG at net/core/skbuff.c:111! > [ 61.372840] invalid opcode: 0000 [#1] SMP PTI > [ 61.374892] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.14.0-rc1 linux-v5.14-rc1-for-mesa-ci.tar.bz2 #1 > [ 61.376450] Hardware name: ChromiumOS crosvm, BIOS 0 > > .. > > [ 61.393635] Call Trace: > [ 61.394127] <IRQ> > [ 61.394488] skb_put.cold+0x10/0x10 > [ 61.395095] page_to_skb+0xf7/0x410 > [ 61.395689] receive_buf+0x81/0x1660 > [ 61.396228] ? netif_receive_skb_list_internal+0x1ad/0x2b0 > [ 61.397180] ? napi_gro_flush+0x97/0xe0 > [ 61.397896] ? detach_buf_split+0x67/0x120 > [ 61.398573] virtnet_poll+0x2cf/0x420 > [ 61.399197] __napi_poll+0x25/0x150 > [ 61.399764] net_rx_action+0x22f/0x280 > [ 61.400394] __do_softirq+0xba/0x257 > [ 61.401012] irq_exit_rcu+0x8e/0xb0 > [ 61.401618] common_interrupt+0x7b/0xa0 > [ 61.402270] </IRQ> > > See > https://lore.kernel.org/r/5edaa2b7c2fe4abd0347b8454b2ac032b6694e2c.camel%40collabora.com > for the report. > > Apply the original 1a8024239da ("virtio-net: fix for skb_over_panic inside big mode") > again, the original logic still holds: > > In virtio-net's large packet mode, there is a hole in the space behind > buf. > > hdr_padded_len - hdr_len > > We must take this into account when calculating tailroom. > > Cc: Greg KH <gregkh at linuxfoundation.org> > Fixes: fb32856b16ad ("virtio-net: page_to_skb() use build_skb when there's sufficient tailroom") > Fixes: 126285651b7f ("Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net") > Signed-off-by: Xuan Zhuo <xuanzhuo at linux.alibaba.com> > Reported-by: Corentin No?l <corentin.noel at collabora.com> > Tested-by: Corentin No?l <corentin.noel at collabora.com> > Signed-off-by: Michael S. Tsirkin <mst at redhat.com> > ---Acked-by: Jason Wang <jasowang at redhat.com>> > David, I think we need this in stable, too. > > drivers/net/virtio_net.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > index 096c2ac6b7a6..6b0812f44bbf 100644 > --- a/drivers/net/virtio_net.c > +++ b/drivers/net/virtio_net.c > @@ -406,7 +406,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, > * add_recvbuf_mergeable() + get_mergeable_buf_len() > */ > truesize = headroom ? PAGE_SIZE : truesize; > - tailroom = truesize - len - headroom; > + tailroom = truesize - len - headroom - (hdr_padded_len - hdr_len); > buf = p - headroom; > > len -= hdr_len; > -- > MST >