From: Neil Horman <nhorman@tuxdriver.com>
To: Steven Rostedt <rostedt@goodmis.org>
Cc: Koki Sanagi <sanagi.koki@jp.fujitsu.com>,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
davem@davemloft.net, mingo@elte.hu, fweisbec@gmail.com,
mathieu.desnoyers@efficios.com, tglx@linutronix.de,
kosaki.motohiro@jp.fujitsu.com, izumi.taku@jp.fujitsu.com,
kaneshige.kenji@jp.fujitsu.com
Subject: Re: [PATCH] ftrace: tracepoint of net_dev_xmit sees freed skb and causes panic
Date: Tue, 31 May 2011 12:11:15 -0400 [thread overview]
Message-ID: <20110531161115.GA3267@hmsreliant.think-freely.org> (raw)
In-Reply-To: <1306854791.11899.30.camel@gandalf.stny.rr.com>
On Tue, May 31, 2011 at 11:13:11AM -0400, Steven Rostedt wrote:
> On Tue, 2011-05-31 at 16:48 +0900, Koki Sanagi wrote:
> > Because there is a possibility that skb is kfree_skb()ed and zero cleared
> > after ndo_start_xmit, we should not see the contents of skb like skb->len and
> > skb->dev->name after ndo_start_xmit. But trace_net_dev_xmit does that
> > and causes panic by NULL pointer dereference.
> > This patch fixes trace_net_dev_xmit not to see the contents of skb directly.
>
>
> >
> > if (likely(!skb->next)) {
> > u32 features;
> > @@ -2139,8 +2140,9 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
> > }
> > }
> >
> > + skb_len = skb->len;
> > rc = ops->ndo_start_xmit(skb, dev);
> > - trace_net_dev_xmit(skb, rc);
> > + trace_net_dev_xmit(skb, rc, dev, skb_len);
> > if (rc == NETDEV_TX_OK)
> > txq_trans_update(txq);
> > return rc;
> > @@ -2160,8 +2162,9 @@ gso:
> > if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
> > skb_dst_drop(nskb);
> >
> > + skb_len = nskb->len;
> > rc = ops->ndo_start_xmit(nskb, dev);
> > - trace_net_dev_xmit(nskb, rc);
> > + trace_net_dev_xmit(nskb, rc, dev, skb_len);
>
> What if you just put the tracepoint before the call to
> ops->ndo_start_xmit?
>
Then you won't know the return code of ndo_start_xmit, which this tracepoint
records.
Neil
> -- Steve
>
> > if (unlikely(rc != NETDEV_TX_OK)) {
> > if (rc & ~NETDEV_TX_MASK)
> > goto out_kfree_gso_skb;
>
>
>
next prev parent reply other threads:[~2011-05-31 16:11 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-31 7:48 [PATCH] ftrace: tracepoint of net_dev_xmit sees freed skb and causes panic Koki Sanagi
2011-05-31 15:13 ` Steven Rostedt
2011-05-31 16:11 ` Neil Horman [this message]
2011-05-31 16:21 ` Steven Rostedt
2011-05-31 15:14 ` Steven Rostedt
2011-06-02 20:59 ` David Miller
2011-06-02 21:01 ` Steven Rostedt
2011-06-02 21:04 ` David Miller
2011-06-03 5:03 ` Koki Sanagi
2011-06-03 5:23 ` David Miller
2011-06-03 5:57 ` Koki Sanagi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110531161115.GA3267@hmsreliant.think-freely.org \
--to=nhorman@tuxdriver.com \
--cc=davem@davemloft.net \
--cc=fweisbec@gmail.com \
--cc=izumi.taku@jp.fujitsu.com \
--cc=kaneshige.kenji@jp.fujitsu.com \
--cc=kosaki.motohiro@jp.fujitsu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mingo@elte.hu \
--cc=netdev@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=sanagi.koki@jp.fujitsu.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).