From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Liu, Changcheng" <changcheng.liu@intel.com>
Subject: Re: [PATCH] net: deal wrong skb and failure ret from
 __tcp_retransmit_skb
Date: Thu, 19 Apr 2018 22:38:36 +0800
Message-ID: <20180419143836.GA109976@sofia>
References: <20180419112653.GA108857@sofia>
 <b2901883-ec63-298c-6e83-edc8db23e4ad@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: netdev@vger.kernel.org, akpm@linux-foundation.org
To: Eric Dumazet <eric.dumazet@gmail.com>, davem@davemloft.net,
        kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org
Return-path: <netdev-owner@vger.kernel.org>
Received: from mga04.intel.com ([192.55.52.120]:11477 "EHLO mga04.intel.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1752876AbeDSOjK (ORCPT <rfc822;netdev@vger.kernel.org>);
        Thu, 19 Apr 2018 10:39:10 -0400
Content-Disposition: inline
In-Reply-To: <b2901883-ec63-298c-6e83-edc8db23e4ad@gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On 06:40 Thu 19 Apr, Eric Dumazet wrote:
> 
> 
> On 04/19/2018 04:26 AM, Liu, Changcheng wrote:
> > Hit below panic due to skb is NULL, WARN wrong skb first.
> > if __tcp_retransmit_skb return failure e.g. -EAGAIN, it
> > needn't do further action in tcp_retransmit_skb.
> > 
> > gdb vmlinux
> > Reading symbols from vmlinux...done.
> > (gdb) p &((struct tcp_skb_cb *) \
> > &(((struct sk_buff *)0)->cb[0]))->tcp_gso_segs
> > $1 = (u16 *) 0x30 <irq_stack_union+48>
> > 
> > [ 9040.917533] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
> > [ 9040.926279] IP: tcp_retransmit_skb+0x5c/0xc0
> > [ 9040.931043] PGD 0 P4D 0
> > [ 9040.933865] Oops: 0000 [#1] PREEMPT SMP PTI
> > [ 9040.972151] RIP: 0010:tcp_retransmit_skb+0x5c/0xc0
> > [ 9040.977496] RSP: 0018:ffff8802bec83e40 EFLAGS: 00010202
> > [ 9041.062527] Call Trace:
> > [ 9041.065250]  <IRQ>
> > [ 9041.067489]  tcp_retransmit_timer+0x481/0x820
> > [ 9041.077697]  tcp_write_timer_handler+0xe9/0x230
> > [ 9041.082751]  tcp_write_timer+0x75/0x80
> > [ 9041.086932]  call_timer_fn+0x29/0x150
> > [ 9041.091018]  run_timer_softirq+0x411/0x460
> > [ 9041.105017]  __do_softirq+0x115/0x311
> > [ 9041.109103]  irq_exit+0xb0/0xc0
> > [ 9041.112605]  smp_apic_timer_interrupt+0x67/0x140
> > 
> > Signed-off-by: Liu Changcheng <changcheng.liu@intel.com>
> > 
> 
> On which kernel have you seen this problem ?
[Changcheng]: My kernel is 4.16.0 Fearless Coyote

> 
> In networking, we want patches with a 'Fixes:' tag to clearly identify which patch
> added a regression.
> 
> 
> Anyway your patch comes too late I guess
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=bffd168c3fc5cc7d2bad4c668fa90e7a9010db4b
[Changcheng]: Check upstream master kernel(head: 87ef12027b9b1), patch
isn't merged yet. I'll check it in my side.

> 
>