Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

[Jason Wang]

cc netdev for more experts

On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
>
> Hi,
>
> I generate a skb as follows:
>
> It has a linear data region, 17 frags and the last fragment is in
> skb_shinfo(skb)->frag_list.
>
> Before this skb is sent to driver, dev_hard_start_xmit() will segment
> it first(skb has frag_list,
>
> so we get true from netif_needs_gso()), then the skb is passed to
> function skb_segment().
>
> Then, BUG_ON() happened.
>
> while (pos < offset + len) {
>
>         if (i >= nfrags) {
>
>                 BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)
>
>                 …
>
>         }
>
>         …
>
> }
>
> A skb that has no frags but frag_list also causes BUG_ON().
>
> I wonder if skb like follows is legal? Could skb in frag_list have
> linear data region?
>
>  
>
>  
>
> Thanks
>
> Zhangjie
>

Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

[Eric Dumazet]

On Thu, 2015-07-30 at 12:26 +0800, Jason Wang wrote:
> cc netdev for more experts
> 
> On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
> >
> > Hi,
> >
> > I generate a skb as follows:
> >
> > It has a linear data region, 17 frags and the last fragment is in
> > skb_shinfo(skb)->frag_list.
> >
> > Before this skb is sent to driver, dev_hard_start_xmit() will segment
> > it first(skb has frag_list,
> >
> > so we get true from netif_needs_gso()), then the skb is passed to
> > function skb_segment().
> >
> > Then, BUG_ON() happened.
> >
> > while (pos < offset + len) {
> >
> >         if (i >= nfrags) {
> >
> >                 BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)
> >
> >                 …
> >
> >         }
> >
> >         …
> >
> > }
> >
> > A skb that has no frags but frag_list also causes BUG_ON().
> >
> > I wonder if skb like follows is legal? Could skb in frag_list have
> > linear data region?

The answer is : skb_segment() is very complex but does not handle all
possible cases.

skb found in skb_shinfo(skb)->frag_list must not have anything in their
skb->head. This would require very expensive logic and memory
allocations and copies.

Make sure you follow this rule in your driver, or even better leave this
work to GRO engine.

RE: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

[Zhangjie (HZ)]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 1896 bytes --]

Get it.
Eric, thanks for your explaination. :-)

Jason, thank you! I will remember cc netdev@vger.kernel.org next time.

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com] 
Sent: Thursday, July 30, 2015 1:01 PM
To: Jason Wang
Cc: Zhangjie (HZ); linux-kernel@vger.kernel.org; mst@redhat.com; Qinchuanyu; Yewudi; liuyongan 00175866; netdev@vger.kernel.org
Subject: Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

On Thu, 2015-07-30 at 12:26 +0800, Jason Wang wrote:
> cc netdev for more experts
> 
> On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
> >
> > Hi,
> >
> > I generate a skb as follows:
> >
> > It has a linear data region, 17 frags and the last fragment is in 
> > skb_shinfo(skb)->frag_list.
> >
> > Before this skb is sent to driver, dev_hard_start_xmit() will 
> > segment it first(skb has frag_list,
> >
> > so we get true from netif_needs_gso()), then the skb is passed to 
> > function skb_segment().
> >
> > Then, BUG_ON() happened.
> >
> > while (pos < offset + len) {
> >
> >         if (i >= nfrags) {
> >
> >                 BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)
> >
> >                 …
> >
> >         }
> >
> >         …
> >
> > }
> >
> > A skb that has no frags but frag_list also causes BUG_ON().
> >
> > I wonder if skb like follows is legal? Could skb in frag_list have 
> > linear data region?

The answer is : skb_segment() is very complex but does not handle all possible cases.

skb found in skb_shinfo(skb)->frag_list must not have anything in their
skb->head. This would require very expensive logic and memory
allocations and copies.

Make sure you follow this rule in your driver, or even better leave this work to GRO engine.



ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

RE: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

[Zhangjie (HZ)]

Get it.
Eric, thanks for your explaination. :-)

Jason, thank you! I will remember cc netdev@vger.kernel.org next time.

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com] 
Sent: Thursday, July 30, 2015 1:01 PM
To: Jason Wang
Cc: Zhangjie (HZ); linux-kernel@vger.kernel.org; mst@redhat.com; Qinchuanyu; Yewudi; liuyongan 00175866; netdev@vger.kernel.org
Subject: Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

On Thu, 2015-07-30 at 12:26 +0800, Jason Wang wrote:
> cc netdev for more experts
> 
> On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
> >
> > Hi,
> >
> > I generate a skb as follows:
> >
> > It has a linear data region, 17 frags and the last fragment is in 
> > skb_shinfo(skb)->frag_list.
> >
> > Before this skb is sent to driver, dev_hard_start_xmit() will 
> > segment it first(skb has frag_list,
> >
> > so we get true from netif_needs_gso()), then the skb is passed to 
> > function skb_segment().
> >
> > Then, BUG_ON() happened.
> >
> > while (pos < offset + len) {
> >
> >         if (i >= nfrags) {
> >
> >                 BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)
> >
> >                 …
> >
> >         }
> >
> >         …
> >
> > }
> >
> > A skb that has no frags but frag_list also causes BUG_ON().
> >
> > I wonder if skb like follows is legal? Could skb in frag_list have 
> > linear data region?

The answer is : skb_segment() is very complex but does not handle all possible cases.

skb found in skb_shinfo(skb)->frag_list must not have anything in their
skb->head. This would require very expensive logic and memory
allocations and copies.

Make sure you follow this rule in your driver, or even better leave this work to GRO engine.