• Sheng Lan's avatar
    net: netem: fix skb length BUG_ON in __skb_to_sgvec · 5845f706
    Sheng Lan authored
    It can be reproduced by following steps:
    1. virtio_net NIC is configured with gso/tso on
    2. configure nginx as http server with an index file bigger than 1M bytes
    3. use tc netem to produce duplicate packets and delay:
       tc qdisc add dev eth0 root netem delay 100ms 10ms 30% duplicate 90%
    4. continually curl the nginx http server to get index file on client
    5. BUG_ON is seen quickly
    
    [10258690.371129] kernel BUG at net/core/skbuff.c:4028!
    [10258690.371748] invalid opcode: 0000 [#1] SMP PTI
    [10258690.372094] CPU: 5 PID: 0 Comm: swapper/5 Tainted: G        W         5.0.0-rc6 #2
    [10258690.372094] RSP: 0018:ffffa05797b43da0 EFLAGS: 00010202
    [10258690.372094] RBP: 00000000000005ea R08: 0000000000000000 R09: 00000000000005ea
    [10258690.372094] R10: ffffa0579334d800 R11: 00000000000002c0 R12: 0000000000000002
    [10258690.372094] R13: 0000000000000000 R14: ffffa05793122900 R15: ffffa0578f7cb028
    [10258690.372094] FS:  0000000000000000(0000) GS:ffffa05797b40000(0000) knlGS:0000000000000000
    [10258690.372094] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [10258690.372094] CR2: 00007f1a6dc00868 CR3: 000000001000e000 CR4: 00000000000006e0
    [10258690.372094] Call Trace:
    [10258690.372094]  <IRQ>
    [10258690.372094]  skb_to_sgvec+0x11/0x40
    [10258690.372094]  start_xmit+0x38c/0x520 [virtio_net]
    [10258690.372094]  dev_hard_start_xmit+0x9b/0x200
    [10258690.372094]  sch_direct_xmit+0xff/0x260
    [10258690.372094]  __qdisc_run+0x15e/0x4e0
    [10258690.372094]  net_tx_action+0x137/0x210
    [10258690.372094]  __do_softirq+0xd6/0x2a9
    [10258690.372094]  irq_exit+0xde/0xf0
    [10258690.372094]  smp_apic_timer_interrupt+0x74/0x140
    [10258690.372094]  apic_timer_interrupt+0xf/0x20
    [10258690.372094]  </IRQ>
    
    In __skb_to_sgvec(), the skb->len is not equal to the sum of the skb's
    linear data size and nonlinear data size, thus BUG_ON triggered.
    Because the skb is cloned and a part of nonlinear data is split off.
    
    Duplicate packet is cloned in netem_enqueue() and may be delayed
    some time in qdisc. When qdisc len reached the limit and returns
    NET_XMIT_DROP, the skb will be retransmit later in write queue.
    the skb will be fragmented by tso_fragment(), the limit size
    that depends on cwnd and mss decrease, the skb's nonlinear
    data will be split off. The length of the skb cloned by netem
    will not be updated. When we use virtio_net NIC and invoke skb_to_sgvec(),
    the BUG_ON trigger.
    
    To fix it, netem returns NET_XMIT_SUCCESS to upper stack
    when it clones a duplicate packet.
    
    Fixes: 35d889d1 ("sch_netem: fix skb leak in netem_enqueue()")
    Signed-off-by: default avatarSheng Lan <lansheng@huawei.com>
    Reported-by: default avatarQin Ji <jiqin.ji@huawei.com>
    Suggested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5845f706
sch_netem.c 30.9 KB