Re: [PATCH v2] net: netem: fix skb length BUG_ON in __skb_to_sgvec

[David Miller <davem@davemloft.net>]

From: Sheng Lan <lansheng@huawei.com>
Date: Thu, 28 Feb 2019 18:47:58 +0800

> From: Sheng Lan <lansheng@huawei.com>
> 
> It can be reproduced by following steps:
> 1. virtio_net NIC is configured with gso/tso on
> 2. configure nginx as http server with an index file bigger than 1M bytes
> 3. use tc netem to produce duplicate packets and delay:
>    tc qdisc add dev eth0 root netem delay 100ms 10ms 30% duplicate 90%
> 4. continually curl the nginx http server to get index file on client
> 5. BUG_ON is seen quickly
 ...
> In __skb_to_sgvec(), the skb->len is not equal to the sum of the skb's
> linear data size and nonlinear data size, thus BUG_ON triggered.
> Because the skb is cloned and a part of nonlinear data is split off.
> 
> Duplicate packet is cloned in netem_enqueue() and may be delayed
> some time in qdisc. When qdisc len reached the limit and returns
> NET_XMIT_DROP, the skb will be retransmit later in write queue.
> the skb will be fragmented by tso_fragment(), the limit size
> that depends on cwnd and mss decrease, the skb's nonlinear
> data will be split off. The length of the skb cloned by netem
> will not be updated. When we use virtio_net NIC and invoke skb_to_sgvec(),
> the BUG_ON trigger.
> 
> To fix it, netem returns NET_XMIT_SUCCESS to upper stack
> when it clones a duplicate packet.
> 
> Fixes: 35d889d1 ("sch_netem: fix skb leak in netem_enqueue()")
> Signed-off-by: Sheng Lan <lansheng@huawei.com>
> Reported-by: Qin Ji <jiqin.ji@huawei.com>
> Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>

Applied and queued up for -stable, thanks.