[OOPS] 2.6.8 and ingress scheduling

[OOPS] 2.6.8 and ingress scheduling

[lkml]

hello,

the last line (filter add) in the "wondershaper" script does sth. to the
kernel, that lets it panic on receiving network packets.

now, if I could capture the trace, that was great... nothing is on disk,
its also more than fits on the screen, and no scrollback exists.

please cc answers/questions,

regards,

peter



PS: excerpt from wondershaper script:

[...]
tc qdisc add dev $DEV handle ffff: ingress
# filter *everything* to it (0.0.0.0/0), drop everything that's
# coming in too fast:

tc filter add dev $DEV parent ffff: protocol ip prio 50 u32 match ip src \
   0.0.0.0/0 police rate ${DOWNLINK}kbit burst 10k drop flowid :1



PPS: likely relevant lines from .config

# QoS and/or fair queueing
#
CONFIG_NET_SCHED=y
# CONFIG_NET_SCH_CLK_JIFFIES is not set
# CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
CONFIG_NET_SCH_CLK_CPU=y
CONFIG_NET_SCH_CBQ=y
CONFIG_NET_SCH_HTB=y
CONFIG_NET_SCH_HFSC=y
CONFIG_NET_SCH_PRIO=y
CONFIG_NET_SCH_RED=y
CONFIG_NET_SCH_SFQ=y
CONFIG_NET_SCH_TEQL=y
CONFIG_NET_SCH_TBF=y
CONFIG_NET_SCH_GRED=y
CONFIG_NET_SCH_DSMARK=y
# CONFIG_NET_SCH_NETEM is not set
CONFIG_NET_SCH_INGRESS=y
CONFIG_NET_QOS=y
CONFIG_NET_ESTIMATOR=y
CONFIG_NET_CLS=y
CONFIG_NET_CLS_TCINDEX=y
CONFIG_NET_CLS_ROUTE4=y
CONFIG_NET_CLS_ROUTE=y
CONFIG_NET_CLS_FW=y
CONFIG_NET_CLS_U32=y
# CONFIG_CLS_U32_PERF is not set
# CONFIG_NET_CLS_IND is not set
CONFIG_NET_CLS_RSVP=y
# CONFIG_NET_CLS_RSVP6 is not set
# CONFIG_NET_CLS_ACT is not set
CONFIG_NET_CLS_POLICE=y

Re: [Panic] 2.6.8 and ingress scheduling

[lkml]

[-- Attachment #1: Type: text/plain, Size: 1616 bytes --]

hello again,

> the last line (filter add) in the "wondershaper" script does sth. to the
> kernel, that lets it panic on receiving network packets.

actually, the last _two_ commands set up the kernel for panic. please
see attached script; running should produce this console message:

HTB init, kernel part version 3.17
Ingress scheduler: Classifier actions prefered over netfilter

shortly then, the kernel will panic (ifconfig shows up to 500KiB RX before).

with vga selection enabled, and a long;) piece of paper, this is produced:
(omissions marked [...] - these numbers are very hard to not misread)


Unable to handle kernel NULL pointer dereference at virtual address 0000000d
 printing eip:
c02080f60
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: [...]
[...]
 Call Trace:
 ip_rcv_finish
 ing_hook
 nf_iterate
 ip_rcv_finish
 ip_rcv_finish
 ing_hook_slow
 ip_rcv_finish
 ip_rcv
 ip_rcv_finish
 netif_receive
 rtl8139_rx
 rtl8139_poll
 net_rx_action
 __do_softirq
 do_IRQ
 common_interrupt
 default_idle
 cpu_idle
 start_kernel
 unknown_bootoption
Code: 8b 43 0c 39 f0 74 43 3d 00 03 00 00 74 3c 8b 1b 85 db 75 ec
 <0>Kernel panic : Fatal exception in interrupt
In interrupt handler - not syncing

eof.

another time, running iptraf, identical Oops, but first line reads:

Unable to handle kernel paging request at virtual address 000a0f0d
[...]
EIP is at ingress_enqueue+0x20/0x90
[...]

the traffic shaping of upstream packets does not panic the kernel; I
also tried a different timer source, to no success.

regards,

peter

attached: output of shaper status, output of lsmod, minimal shaper script.

[-- Attachment #2: wshaper.status.txt --]
[-- Type: text/plain, Size: 196 bytes --]

qdisc pfifo_fast 0: [Unknown qdisc, optlen=20] 
 Sent 50124 bytes 582 pkts (dropped 0, overlimits 0) 

qdisc ingress ffff: ---------------- 
 Sent 66193 bytes 575 pkts (dropped 0, overlimits 0) 


[-- Attachment #3: lsmod.txt --]
[-- Type: text/plain, Size: 1226 bytes --]

Module                  Size  Used by
snd_via82xx            23204  - 
snd_mpu401_uart         5608  - 
ehci_hcd               25260  - 
uhci_hcd               28568  - 
usbcore               100292  - 
snd_bt87x              10952  - 
tuner                  18680  - 
bttv                  145196  - 
video_buf              16844  - 
i2c_algo_bit            8720  - 
v4l2_common             4712  - 
btcx_risc               3664  - 
videodev                6720  - 
snd_ens1371            18760  - 
snd_rawmidi            19300  - 
snd_seq_device          6256  - 
snd_pcm_oss            48360  - 
snd_mixer_oss          16904  - 
snd_pcm                81704  - 
snd_page_alloc          8752  - 
snd_timer              19628  - 
snd_ac97_codec         65548  - 
snd                    43684  - 
soundcore               6560  - 
8139too                19912  - 
ohci1394               30764  - 
ieee1394               91732  - 
w83627hf               27436  - 
eeprom                  6064  - 
i2c_sensor              2152  - 
i2c_isa                 1480  - 
i2c_viapro              5780  - 
i2c_core               18328  - 
ide_cd                 37824  - 
cdrom                  36892  - 
loop                   11888  - 

[-- Attachment #4: ingress-shaper.sh --]
[-- Type: application/x-sh, Size: 377 bytes --]

Re: [Panic] 2.6.8 and ingress scheduling

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 499 bytes --]

lkml@lazy.shacknet.nu wrote:

>hello again,
>
>  
>
>>the last line (filter add) in the "wondershaper" script does sth. to the
>>kernel, that lets it panic on receiving network packets.
>>    
>>
>
>actually, the last _two_ commands set up the kernel for panic. please
>see attached script; running should produce this console message:
>  
>
Fixed by this patch. qdisc_data was only aligned correctly in 
qdisc_create_dflt(),
not qdisc_create() which resulted in memory corruption.

Regards
Patrick

[-- Attachment #2: qdisc-align.diff --]
[-- Type: text/x-patch, Size: 1656 bytes --]

# This is a BitKeeper generated diff -Nru style patch.
#
# ChangeSet
#   2004/08/15 18:08:13+02:00 kaber@coreworks.de 
#   [PKT_SCHED]: cacheline-align qdisc data in qdisc_create()
#   
#   Signed-off-by: Patrick McHardy <kaber@trash.net>
# 
# net/sched/sch_api.c
#   2004/08/15 18:04:27+02:00 kaber@coreworks.de +13 -8
#   [PKT_SCHED]: cacheline-align qdisc data in qdisc_create()
# 
diff -Nru a/net/sched/sch_api.c b/net/sched/sch_api.c
--- a/net/sched/sch_api.c	2004-08-15 18:09:36 +02:00
+++ b/net/sched/sch_api.c	2004-08-15 18:09:36 +02:00
@@ -389,7 +389,8 @@
 {
 	int err;
 	struct rtattr *kind = tca[TCA_KIND-1];
-	struct Qdisc *sch = NULL;
+	void *p = NULL;
+	struct Qdisc *sch;
 	struct Qdisc_ops *ops;
 	int size;
 
@@ -407,12 +408,18 @@
 	if (ops == NULL)
 		goto err_out;
 
-	size = sizeof(*sch) + ops->priv_size;
+	/* ensure that the Qdisc and the private data are 32-byte aligned */
+	size = ((sizeof(*sch) + QDISC_ALIGN_CONST) & ~QDISC_ALIGN_CONST);
+	size += ops->priv_size + QDISC_ALIGN_CONST;
 
-	sch = kmalloc(size, GFP_KERNEL);
+	p = kmalloc(size, GFP_KERNEL);
 	err = -ENOBUFS;
-	if (!sch)
+	if (!p)
 		goto err_out;
+	memset(p, 0, size);
+	sch = (struct Qdisc *)(((unsigned long)p + QDISC_ALIGN_CONST)
+	                       & ~QDISC_ALIGN_CONST);
+	sch->padded = (char *)sch - (char *)p;
 
 	/* Grrr... Resolve race condition with module unload */
 
@@ -420,8 +427,6 @@
 	if (ops != qdisc_lookup_ops(kind))
 		goto err_out;
 
-	memset(sch, 0, size);
-
 	INIT_LIST_HEAD(&sch->list);
 	skb_queue_head_init(&sch->q);
 
@@ -470,8 +475,8 @@
 
 err_out:
 	*errp = err;
-	if (sch)
-		kfree(sch);
+	if (p)
+		kfree(p);
 	return NULL;
 }
 

Re: [Panic] 2.6.8 and ingress scheduling

[David S. Miller]

On Sun, 15 Aug 2004 18:12:00 +0200
Patrick McHardy <kaber@trash.net> wrote:

> Fixed by this patch. qdisc_data was only aligned correctly in 
> qdisc_create_dflt(),
> not qdisc_create() which resulted in memory corruption.

Oops, thanks Patrick.  Patch applied.

Re: [OOPS] 2.6.8 and ingress scheduling

[Andreas Sundstrom]

> hello,
> 
> the last line (filter add) in the "wondershaper" script does sth. to the
> kernel, that lets it panic on receiving network packets.
> 
> now, if I could capture the trace, that was great... nothing is on disk,
> its also more than fits on the screen, and no scrollback exists.
> 
> please cc answers/questions,
> 
> regards,
> 
> peter
[...]

I can confirm that I have this problem too.
If anyone want me to try a patch just let me know.

/Andreas Sundstrom