Re: Xen bug or sky2 device driver bug?

["Jan Beulich" <jbeulich@novell.com>]

[-- Attachment #1: Type: text/plain, Size: 1317 bytes --]

We had determined this to be a problem in the bridge netfilter code, in that it can't
deal with skb-s that have no headroom set up (for alignment purposes), as the
sky2 driver appears to do.

I'm attaching the patch we use to address this in SLE10.

Jan

>>> Jae-Wan Jang <jwjang@camars.kaist.ac.kr> 18.08.06 09:50 >>>
Hello,

I'm using ASUS P5WD2-E Premium mother board.
It has two Marvell Yukon II gigabit Ethernet and sky2 device driver is
used for them.

When domU receives lots of lots of packets (about 10Kb each),
dom0 crashes.
Unfortunately, my machine doesn't have serial port, I can't capture all
the oops messages.
Following is backtrace of the oops messages.

When domU receives lots of packets from other physical machine, kernel
panic occurs.

Backtrace

br_handle_frame
br_nf_pre_routing_finish
br_nf_pre_routing
nf_iterate
nf_hook_slow
br_handle_frame
netif_receive_skb
sky2_poll
net_rx_action
__do_softirq
irq_exit
do_IRQ
evtchn_do_upcall
hypervisor_callback
xen_idle
cpu_idle
rest_init
start_kernel
0xc010006f

Is it bug of Xen or sky2 device?

Thanks in advance.

-- 

Jae-Wan Jang
jwjang@camars.kaist.ac.kr
+82-42-869-3559
http://camars.kaist.ac.kr/~jwjang


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

[-- Attachment #2: nf_bridge-header-size --]
[-- Type: application/octet-stream, Size: 1279 bytes --]

Subject: nf_bridge: ethernet header is 14 not 16 bytes
From: jbeulich@novell.com
Acked-by: kraxel@suse.de
References: 150410

The bridge netfilter code saves two more bytes that it should.
In most cases it doesn't hurt because many drivers use NET_IP_ALIGN
to make the IP header aligned, so there are two extra bytes head room
available.

Some drivers don't do that though (sky2 for example), so copying
accesses data outside the skbuff data allocation.  On xen kernels
this can kill the machine with a page fault due to the way how
skbuffs are allocated and the memory is managed.

Index: linux-2.6.16/include/linux/netfilter_bridge.h
===================================================================
--- linux-2.6.16.orig/include/linux/netfilter_bridge.h
+++ linux-2.6.16/include/linux/netfilter_bridge.h
@@ -73,14 +73,14 @@ void nf_bridge_maybe_copy_header(struct 
 			memcpy(skb->data - 18, skb->nf_bridge->data, 18);
 			skb_push(skb, 4);
 		} else
-			memcpy(skb->data - 16, skb->nf_bridge->data, 16);
+			memcpy(skb->data - 14, skb->nf_bridge->data, 14);
 	}
 }
 
 static inline
 void nf_bridge_save_header(struct sk_buff *skb)
 {
-        int header_size = 16;
+        int header_size = 14;
 
 	if (skb->protocol == __constant_htons(ETH_P_8021Q))
 		header_size = 18;

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel