* Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
@ 2012-09-04 16:07 Stephen Hemminger
2012-09-04 19:52 ` Eric Dumazet
0 siblings, 1 reply; 7+ messages in thread
From: Stephen Hemminger @ 2012-09-04 16:07 UTC (permalink / raw)
To: netdev
Begin forwarded message:
Date: Tue, 4 Sep 2012 16:06:06 +0000 (UTC)
From: bugzilla-daemon@bugzilla.kernel.org
To: shemminger@linux-foundation.org
Subject: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
https://bugzilla.kernel.org/show_bug.cgi?id=47021
Summary: kernel panic with l2tpv3 & mtu > 1500
Product: Networking
Version: 2.5
Kernel Version: 3.2.28
Platform: All
OS/Version: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: Other
AssignedTo: shemminger@linux-foundation.org
ReportedBy: a1bert@atlas.cz
Regression: No
first l2tpv3 packet that enters physical device with MTU > 1500 causes kernel
panic
tunel created using:
l2tpv3tun add tunnel tunnel_id 1 peer_tunnel_id 1 encap udp udp_sport 5001
udp_dport 5001 local 192.168.1.1 remote 192.168.1.2
l2tpv3tun add session tunnel_id 1 session_id 1 peer_session_id 1 dev l2tpeth1
reproducible: always
--
Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
2012-09-04 16:07 Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 Stephen Hemminger
@ 2012-09-04 19:52 ` Eric Dumazet
2012-09-04 19:54 ` Stephen Hemminger
2012-09-04 19:55 ` David Miller
0 siblings, 2 replies; 7+ messages in thread
From: Eric Dumazet @ 2012-09-04 19:52 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev, a1bert
From: Eric Dumazet <edumazet@google.com>
On Tue, 2012-09-04 at 09:07 -0700, Stephen Hemminger wrote:
>
> Begin forwarded message:
>
> Date: Tue, 4 Sep 2012 16:06:06 +0000 (UTC)
> From: bugzilla-daemon@bugzilla.kernel.org
> To: shemminger@linux-foundation.org
> Subject: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
>
>
> https://bugzilla.kernel.org/show_bug.cgi?id=47021
>
> Summary: kernel panic with l2tpv3 & mtu > 1500
> Product: Networking
> Version: 2.5
> Kernel Version: 3.2.28
> Platform: All
> OS/Version: Linux
> Tree: Mainline
> Status: NEW
> Severity: normal
> Priority: P1
> Component: Other
> AssignedTo: shemminger@linux-foundation.org
> ReportedBy: a1bert@atlas.cz
> Regression: No
>
>
> first l2tpv3 packet that enters physical device with MTU > 1500 causes kernel
> panic
>
> tunel created using:
>
> l2tpv3tun add tunnel tunnel_id 1 peer_tunnel_id 1 encap udp udp_sport 5001
> udp_dport 5001 local 192.168.1.1 remote 192.168.1.2
>
> l2tpv3tun add session tunnel_id 1 session_id 1 peer_session_id 1 dev l2tpeth1
>
>
> reproducible: always
>
Seems following patch is needed, not sure if it helps
[PATCH] l2tp: fix a typo in l2tp_eth_dev_recv()
While investigating l2tp bug, I hit a bug in eth_type_trans(),
because not enough bytes were pulled in skb head.
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/l2tp/l2tp_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index f9ee74d..3bfb34a 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
}
- if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
+ if (!pskb_may_pull(skb, ETH_HLEN))
goto error;
secpath_reset(skb);
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
2012-09-04 19:52 ` Eric Dumazet
@ 2012-09-04 19:54 ` Stephen Hemminger
2012-09-04 20:57 ` Eric Dumazet
2012-09-05 7:45 ` a1
2012-09-04 19:55 ` David Miller
1 sibling, 2 replies; 7+ messages in thread
From: Stephen Hemminger @ 2012-09-04 19:54 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev, a1bert
On Tue, 04 Sep 2012 21:52:14 +0200
Eric Dumazet <eric.dumazet@gmail.com> wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> On Tue, 2012-09-04 at 09:07 -0700, Stephen Hemminger wrote:
> >
> > Begin forwarded message:
> >
> > Date: Tue, 4 Sep 2012 16:06:06 +0000 (UTC)
> > From: bugzilla-daemon@bugzilla.kernel.org
> > To: shemminger@linux-foundation.org
> > Subject: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
> >
> >
> > https://bugzilla.kernel.org/show_bug.cgi?id=47021
> >
> > Summary: kernel panic with l2tpv3 & mtu > 1500
> > Product: Networking
> > Version: 2.5
> > Kernel Version: 3.2.28
> > Platform: All
> > OS/Version: Linux
> > Tree: Mainline
> > Status: NEW
> > Severity: normal
> > Priority: P1
> > Component: Other
> > AssignedTo: shemminger@linux-foundation.org
> > ReportedBy: a1bert@atlas.cz
> > Regression: No
> >
> >
> > first l2tpv3 packet that enters physical device with MTU > 1500 causes kernel
> > panic
> >
> > tunel created using:
> >
> > l2tpv3tun add tunnel tunnel_id 1 peer_tunnel_id 1 encap udp udp_sport 5001
> > udp_dport 5001 local 192.168.1.1 remote 192.168.1.2
> >
> > l2tpv3tun add session tunnel_id 1 session_id 1 peer_session_id 1 dev l2tpeth1
> >
> >
> > reproducible: always
> >
>
> Seems following patch is needed, not sure if it helps
>
> [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv()
>
> While investigating l2tp bug, I hit a bug in eth_type_trans(),
> because not enough bytes were pulled in skb head.
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> net/l2tp/l2tp_eth.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
> index f9ee74d..3bfb34a 100644
> --- a/net/l2tp/l2tp_eth.c
> +++ b/net/l2tp/l2tp_eth.c
> @@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
> print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
> }
>
> - if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
> + if (!pskb_may_pull(skb, ETH_HLEN))
> goto error;
I guess nobody ever looked inside this code. That seems like an obvious bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
2012-09-04 19:52 ` Eric Dumazet
2012-09-04 19:54 ` Stephen Hemminger
@ 2012-09-04 19:55 ` David Miller
1 sibling, 0 replies; 7+ messages in thread
From: David Miller @ 2012-09-04 19:55 UTC (permalink / raw)
To: eric.dumazet; +Cc: shemminger, netdev, a1bert
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Tue, 04 Sep 2012 21:52:14 +0200
> [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv()
>
> While investigating l2tp bug, I hit a bug in eth_type_trans(),
> because not enough bytes were pulled in skb head.
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
LoL, applied and queued up for -stable.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
2012-09-04 19:54 ` Stephen Hemminger
@ 2012-09-04 20:57 ` Eric Dumazet
2012-09-05 7:45 ` a1
1 sibling, 0 replies; 7+ messages in thread
From: Eric Dumazet @ 2012-09-04 20:57 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev, a1bert
On Tue, 2012-09-04 at 12:54 -0700, Stephen Hemminger wrote:
>
> I guess nobody ever looked inside this code. That seems like an obvious bug.
It seems that l2tp lacks ECN support as well.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
2012-09-04 19:54 ` Stephen Hemminger
2012-09-04 20:57 ` Eric Dumazet
@ 2012-09-05 7:45 ` a1
2012-09-05 8:34 ` Eric Dumazet
1 sibling, 1 reply; 7+ messages in thread
From: a1 @ 2012-09-05 7:45 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: Eric Dumazet, netdev
Thanks, it definitely helped, no more panics now...
jn
>>>
>>
>> Seems following patch is needed, not sure if it helps
>>
>> [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv()
>>
>> While investigating l2tp bug, I hit a bug in eth_type_trans(),
>> because not enough bytes were pulled in skb head.
>>
>> Signed-off-by: Eric Dumazet <edumazet@google.com>
>> ---
>> net/l2tp/l2tp_eth.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
>> index f9ee74d..3bfb34a 100644
>> --- a/net/l2tp/l2tp_eth.c
>> +++ b/net/l2tp/l2tp_eth.c
>> @@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
>> print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
>> }
>>
>> - if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
>> + if (!pskb_may_pull(skb, ETH_HLEN))
>> goto error;
>
> I guess nobody ever looked inside this code. That seems like an obvious bug.
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500
2012-09-05 7:45 ` a1
@ 2012-09-05 8:34 ` Eric Dumazet
0 siblings, 0 replies; 7+ messages in thread
From: Eric Dumazet @ 2012-09-05 8:34 UTC (permalink / raw)
To: a1; +Cc: Stephen Hemminger, netdev
On Wed, 2012-09-05 at 09:45 +0200, a1 wrote:
> Thanks, it definitely helped, no more panics now...
It seems MTU of device is wrong, and lot of packets are fragmented...
Its currently 1488, but it really should be less than that (accounting
for the IP+UDP header)
I wonder if anybody ever used this code ?
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-09-05 8:34 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-09-04 16:07 Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 Stephen Hemminger
2012-09-04 19:52 ` Eric Dumazet
2012-09-04 19:54 ` Stephen Hemminger
2012-09-04 20:57 ` Eric Dumazet
2012-09-05 7:45 ` a1
2012-09-05 8:34 ` Eric Dumazet
2012-09-04 19:55 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.