From: Jakub Kicinski <jakub.kicinski@netronome.com>
To: David Miller <davem@davemloft.net>
Cc: stephen@networkplumber.org, jhs@mojatatu.com,
xiyou.wangcong@gmail.com, jiri@resnulli.us,
netem@lists.linux-foundation.org, netdev@vger.kernel.org,
oss-drivers@netronome.com, edumazet@google.com, posk@google.com
Subject: Re: [PATCH net] net: netem: fix use after free and double free with packet corruption
Date: Sat, 15 Jun 2019 13:25:07 -0700 [thread overview]
Message-ID: <20190615132507.49589073@cakuba.netronome.com> (raw)
In-Reply-To: <20190614.190808.2204923376726716417.davem@davemloft.net>
On Fri, 14 Jun 2019 19:08:08 -0700 (PDT), David Miller wrote:
> From: Jakub Kicinski <jakub.kicinski@netronome.com>
> Date: Wed, 12 Jun 2019 11:51:21 -0700
>
> > Brendan reports that the use of netem's packet corruption capability
> > leads to strange crashes. This seems to be caused by
> > commit d66280b12bd7 ("net: netem: use a list in addition to rbtree")
> > which uses skb->next pointer to construct a fast-path queue of
> > in-order skbs.
> >
> > Packet corruption code has to invoke skb_gso_segment() in case
> > of skbs in need of GSO. skb_gso_segment() returns a list of
> > skbs. If next pointers of the skbs on that list do not get cleared
> > fast path list goes into the weeds and tries to access the next
> > segment skb multiple times.
> >
> > Reported-by: Brendan Galloway <brendan.galloway@netronome.com>
> > Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree")
> > Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> > Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
>
> Please rework the commit message a bit to make things cleared, your
> ascii diagrams would be great. :)
In process of rewriting the commit message I found a memory leak,
and the backlog accounting is also buggy in the segmentation path
qdisc netem 8001: root refcnt 64 limit 100 delay 19us corrupt 1%
Sent 30237896 bytes 19895 pkt (dropped 1885, overlimits 0 requeues 287)
backlog 0b 99p requeues 287
^^^^^^
99 packets but 0 bytes
I need an internal review, and will repost soon. I need to stop looking
for bugs here 🙈
prev parent reply other threads:[~2019-06-15 20:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-12 18:51 [PATCH net] net: netem: fix use after free and double free with packet corruption Jakub Kicinski
2019-06-14 16:40 ` Cong Wang
2019-06-15 0:16 ` Jakub Kicinski
2019-06-15 2:08 ` David Miller
2019-06-15 20:25 ` Jakub Kicinski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190615132507.49589073@cakuba.netronome.com \
--to=jakub.kicinski@netronome.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=netdev@vger.kernel.org \
--cc=netem@lists.linux-foundation.org \
--cc=oss-drivers@netronome.com \
--cc=posk@google.com \
--cc=stephen@networkplumber.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).