Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

3 messages, 3 authors, 2015-07-30 · open the first message on its own page

Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

From: Jason Wang <hidden>
Date: 2015-07-30 04:26:26

cc netdev for more experts

On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
Hi,

I generate a skb as follows:

It has a linear data region, 17 frags and the last fragment is in
skb_shinfo(skb)->frag_list.

Before this skb is sent to driver, dev_hard_start_xmit() will segment
it first(skb has frag_list,

so we get true from netif_needs_gso()), then the skb is passed to
function skb_segment().

Then, BUG_ON() happened.

while (pos < offset + len) {

        if (i >= nfrags) {

                BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)

                …

        }

        …

}

A skb that has no frags but frag_list also causes BUG_ON().

I wonder if skb like follows is legal? Could skb in frag_list have
linear data region?

 

 

Thanks

Zhangjie

Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

From: Eric Dumazet <hidden>
Date: 2015-07-30 05:01:08

On Thu, 2015-07-30 at 12:26 +0800, Jason Wang wrote:
cc netdev for more experts

On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
quoted
Hi,

I generate a skb as follows:

It has a linear data region, 17 frags and the last fragment is in
skb_shinfo(skb)->frag_list.

Before this skb is sent to driver, dev_hard_start_xmit() will segment
it first(skb has frag_list,

so we get true from netif_needs_gso()), then the skb is passed to
function skb_segment().

Then, BUG_ON() happened.

while (pos < offset + len) {

        if (i >= nfrags) {

                BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)

                …

        }

        …

}

A skb that has no frags but frag_list also causes BUG_ON().

I wonder if skb like follows is legal? Could skb in frag_list have
linear data region?
The answer is : skb_segment() is very complex but does not handle all
possible cases.

skb found in skb_shinfo(skb)->frag_list must not have anything in their
skb->head. This would require very expensive logic and memory
allocations and copies.

Make sure you follow this rule in your driver, or even better leave this
work to GRO engine.

RE: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

From: Zhangjie (HZ) <hidden>
Date: 2015-07-30 05:57:08

Get it.
Eric, thanks for your explaination. :-)

Jason, thank you! I will remember cc netdev@vger.kernel.org next time.

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@gmail.com] 
Sent: Thursday, July 30, 2015 1:01 PM
To: Jason Wang
Cc: Zhangjie (HZ); linux-kernel@vger.kernel.org; mst@redhat.com; Qinchuanyu; Yewudi; liuyongan 00175866; netdev@vger.kernel.org
Subject: Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment

On Thu, 2015-07-30 at 12:26 +0800, Jason Wang wrote:
cc netdev for more experts

On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote:
quoted
Hi,

I generate a skb as follows:

It has a linear data region, 17 frags and the last fragment is in 
skb_shinfo(skb)->frag_list.

Before this skb is sent to driver, dev_hard_start_xmit() will 
segment it first(skb has frag_list,

so we get true from netif_needs_gso()), then the skb is passed to 
function skb_segment().

Then, BUG_ON() happened.

while (pos < offset + len) {

        if (i >= nfrags) {

                BUG_ON(skb_headlen(list_skb));    (skbuff.c:3120)

                …

        }

        …

}

A skb that has no frags but frag_list also causes BUG_ON().

I wonder if skb like follows is legal? Could skb in frag_list have 
linear data region?
The answer is : skb_segment() is very complex but does not handle all possible cases.

skb found in skb_shinfo(skb)->frag_list must not have anything in their
skb->head. This would require very expensive logic and memory
allocations and copies.

Make sure you follow this rule in your driver, or even better leave this work to GRO engine.


Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help