* Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 @ 2012-09-04 16:07 Stephen Hemminger 2012-09-04 19:52 ` Eric Dumazet 0 siblings, 1 reply; 7+ messages in thread From: Stephen Hemminger @ 2012-09-04 16:07 UTC (permalink / raw) To: netdev Begin forwarded message: Date: Tue, 4 Sep 2012 16:06:06 +0000 (UTC) From: bugzilla-daemon@bugzilla.kernel.org To: shemminger@linux-foundation.org Subject: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 https://bugzilla.kernel.org/show_bug.cgi?id=47021 Summary: kernel panic with l2tpv3 & mtu > 1500 Product: Networking Version: 2.5 Kernel Version: 3.2.28 Platform: All OS/Version: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: Other AssignedTo: shemminger@linux-foundation.org ReportedBy: a1bert@atlas.cz Regression: No first l2tpv3 packet that enters physical device with MTU > 1500 causes kernel panic tunel created using: l2tpv3tun add tunnel tunnel_id 1 peer_tunnel_id 1 encap udp udp_sport 5001 udp_dport 5001 local 192.168.1.1 remote 192.168.1.2 l2tpv3tun add session tunnel_id 1 session_id 1 peer_session_id 1 dev l2tpeth1 reproducible: always -- Configure bugmail: https://bugzilla.kernel.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 2012-09-04 16:07 Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 Stephen Hemminger @ 2012-09-04 19:52 ` Eric Dumazet 2012-09-04 19:54 ` Stephen Hemminger 2012-09-04 19:55 ` David Miller 0 siblings, 2 replies; 7+ messages in thread From: Eric Dumazet @ 2012-09-04 19:52 UTC (permalink / raw) To: Stephen Hemminger; +Cc: netdev, a1bert From: Eric Dumazet <edumazet@google.com> On Tue, 2012-09-04 at 09:07 -0700, Stephen Hemminger wrote: > > Begin forwarded message: > > Date: Tue, 4 Sep 2012 16:06:06 +0000 (UTC) > From: bugzilla-daemon@bugzilla.kernel.org > To: shemminger@linux-foundation.org > Subject: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 > > > https://bugzilla.kernel.org/show_bug.cgi?id=47021 > > Summary: kernel panic with l2tpv3 & mtu > 1500 > Product: Networking > Version: 2.5 > Kernel Version: 3.2.28 > Platform: All > OS/Version: Linux > Tree: Mainline > Status: NEW > Severity: normal > Priority: P1 > Component: Other > AssignedTo: shemminger@linux-foundation.org > ReportedBy: a1bert@atlas.cz > Regression: No > > > first l2tpv3 packet that enters physical device with MTU > 1500 causes kernel > panic > > tunel created using: > > l2tpv3tun add tunnel tunnel_id 1 peer_tunnel_id 1 encap udp udp_sport 5001 > udp_dport 5001 local 192.168.1.1 remote 192.168.1.2 > > l2tpv3tun add session tunnel_id 1 session_id 1 peer_session_id 1 dev l2tpeth1 > > > reproducible: always > Seems following patch is needed, not sure if it helps [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv() While investigating l2tp bug, I hit a bug in eth_type_trans(), because not enough bytes were pulled in skb head. Signed-off-by: Eric Dumazet <edumazet@google.com> --- net/l2tp/l2tp_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c index f9ee74d..3bfb34a 100644 --- a/net/l2tp/l2tp_eth.c +++ b/net/l2tp/l2tp_eth.c @@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length); } - if (!pskb_may_pull(skb, sizeof(ETH_HLEN))) + if (!pskb_may_pull(skb, ETH_HLEN)) goto error; secpath_reset(skb); ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 2012-09-04 19:52 ` Eric Dumazet @ 2012-09-04 19:54 ` Stephen Hemminger 2012-09-04 20:57 ` Eric Dumazet 2012-09-05 7:45 ` a1 2012-09-04 19:55 ` David Miller 1 sibling, 2 replies; 7+ messages in thread From: Stephen Hemminger @ 2012-09-04 19:54 UTC (permalink / raw) To: Eric Dumazet; +Cc: netdev, a1bert On Tue, 04 Sep 2012 21:52:14 +0200 Eric Dumazet <eric.dumazet@gmail.com> wrote: > From: Eric Dumazet <edumazet@google.com> > > On Tue, 2012-09-04 at 09:07 -0700, Stephen Hemminger wrote: > > > > Begin forwarded message: > > > > Date: Tue, 4 Sep 2012 16:06:06 +0000 (UTC) > > From: bugzilla-daemon@bugzilla.kernel.org > > To: shemminger@linux-foundation.org > > Subject: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 > > > > > > https://bugzilla.kernel.org/show_bug.cgi?id=47021 > > > > Summary: kernel panic with l2tpv3 & mtu > 1500 > > Product: Networking > > Version: 2.5 > > Kernel Version: 3.2.28 > > Platform: All > > OS/Version: Linux > > Tree: Mainline > > Status: NEW > > Severity: normal > > Priority: P1 > > Component: Other > > AssignedTo: shemminger@linux-foundation.org > > ReportedBy: a1bert@atlas.cz > > Regression: No > > > > > > first l2tpv3 packet that enters physical device with MTU > 1500 causes kernel > > panic > > > > tunel created using: > > > > l2tpv3tun add tunnel tunnel_id 1 peer_tunnel_id 1 encap udp udp_sport 5001 > > udp_dport 5001 local 192.168.1.1 remote 192.168.1.2 > > > > l2tpv3tun add session tunnel_id 1 session_id 1 peer_session_id 1 dev l2tpeth1 > > > > > > reproducible: always > > > > Seems following patch is needed, not sure if it helps > > [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv() > > While investigating l2tp bug, I hit a bug in eth_type_trans(), > because not enough bytes were pulled in skb head. > > Signed-off-by: Eric Dumazet <edumazet@google.com> > --- > net/l2tp/l2tp_eth.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c > index f9ee74d..3bfb34a 100644 > --- a/net/l2tp/l2tp_eth.c > +++ b/net/l2tp/l2tp_eth.c > @@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, > print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length); > } > > - if (!pskb_may_pull(skb, sizeof(ETH_HLEN))) > + if (!pskb_may_pull(skb, ETH_HLEN)) > goto error; I guess nobody ever looked inside this code. That seems like an obvious bug. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 2012-09-04 19:54 ` Stephen Hemminger @ 2012-09-04 20:57 ` Eric Dumazet 2012-09-05 7:45 ` a1 1 sibling, 0 replies; 7+ messages in thread From: Eric Dumazet @ 2012-09-04 20:57 UTC (permalink / raw) To: Stephen Hemminger; +Cc: netdev, a1bert On Tue, 2012-09-04 at 12:54 -0700, Stephen Hemminger wrote: > > I guess nobody ever looked inside this code. That seems like an obvious bug. It seems that l2tp lacks ECN support as well. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 2012-09-04 19:54 ` Stephen Hemminger 2012-09-04 20:57 ` Eric Dumazet @ 2012-09-05 7:45 ` a1 2012-09-05 8:34 ` Eric Dumazet 1 sibling, 1 reply; 7+ messages in thread From: a1 @ 2012-09-05 7:45 UTC (permalink / raw) To: Stephen Hemminger; +Cc: Eric Dumazet, netdev Thanks, it definitely helped, no more panics now... jn >>> >> >> Seems following patch is needed, not sure if it helps >> >> [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv() >> >> While investigating l2tp bug, I hit a bug in eth_type_trans(), >> because not enough bytes were pulled in skb head. >> >> Signed-off-by: Eric Dumazet <edumazet@google.com> >> --- >> net/l2tp/l2tp_eth.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c >> index f9ee74d..3bfb34a 100644 >> --- a/net/l2tp/l2tp_eth.c >> +++ b/net/l2tp/l2tp_eth.c >> @@ -153,7 +153,7 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, >> print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length); >> } >> >> - if (!pskb_may_pull(skb, sizeof(ETH_HLEN))) >> + if (!pskb_may_pull(skb, ETH_HLEN)) >> goto error; > > I guess nobody ever looked inside this code. That seems like an obvious bug. > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 2012-09-05 7:45 ` a1 @ 2012-09-05 8:34 ` Eric Dumazet 0 siblings, 0 replies; 7+ messages in thread From: Eric Dumazet @ 2012-09-05 8:34 UTC (permalink / raw) To: a1; +Cc: Stephen Hemminger, netdev On Wed, 2012-09-05 at 09:45 +0200, a1 wrote: > Thanks, it definitely helped, no more panics now... It seems MTU of device is wrong, and lot of packets are fragmented... Its currently 1488, but it really should be less than that (accounting for the IP+UDP header) I wonder if anybody ever used this code ? ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 2012-09-04 19:52 ` Eric Dumazet 2012-09-04 19:54 ` Stephen Hemminger @ 2012-09-04 19:55 ` David Miller 1 sibling, 0 replies; 7+ messages in thread From: David Miller @ 2012-09-04 19:55 UTC (permalink / raw) To: eric.dumazet; +Cc: shemminger, netdev, a1bert From: Eric Dumazet <eric.dumazet@gmail.com> Date: Tue, 04 Sep 2012 21:52:14 +0200 > [PATCH] l2tp: fix a typo in l2tp_eth_dev_recv() > > While investigating l2tp bug, I hit a bug in eth_type_trans(), > because not enough bytes were pulled in skb head. > > Signed-off-by: Eric Dumazet <edumazet@google.com> LoL, applied and queued up for -stable. ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2012-09-05 8:34 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2012-09-04 16:07 Fw: [Bug 47021] New: kernel panic with l2tpv3 & mtu > 1500 Stephen Hemminger 2012-09-04 19:52 ` Eric Dumazet 2012-09-04 19:54 ` Stephen Hemminger 2012-09-04 20:57 ` Eric Dumazet 2012-09-05 7:45 ` a1 2012-09-05 8:34 ` Eric Dumazet 2012-09-04 19:55 ` David Miller
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.