Bug 468890 - BUG() call in net/core/skbuff.c in function ___pksb_trim()
BUG() call in net/core/skbuff.c in function ___pksb_trim()
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
x86_64 Linux
medium Severity high
: rc
: ---
Assigned To: Michal Schmidt
Martin Jenner
Depends On:
  Show dependency treegraph
Reported: 2008-10-28 13:10 EDT by keith.d.schincke
Modified: 2009-05-18 15:32 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-05-18 15:32:39 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch to correct problem (6.04 KB, patch)
2008-10-31 09:24 EDT, keith.d.schincke
no flags Details | Diff
rhel4: fix BUG() in rx of LLC frames in non-linear skbs (5.08 KB, patch)
2008-12-16 21:05 EST, Michal Schmidt
no flags Details | Diff
rhel4: fix BUG() in rx of LLC frames in non-linear skbs [v3] (3.88 KB, patch)
2008-12-22 11:57 EST, Michal Schmidt
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Linux Kernel 6409 None None None Never

  None (edit)
Description keith.d.schincke 2008-10-28 13:10:35 EDT
Description of problem:
The ___pskb_trim() function in net/core/skbuff.c will call a BUG() macro if "realloc==0 and trimming is impossible without change of data". This results in a stack dump a a kernel oops. 

Version-Release number of selected component (if applicable):

How reproducible:
Used a Dell PE 2950 with Intel Gig Ethernet

Steps to Reproduce:
1. Listen to significant amounts of network traffic with fragmentation. 
Actual results:
Kernel oops on the BUG() call.

Expected results:
Normal operation

Additional info:
Attached is a patch to correct the kernel bug and to add support for pskb_trim_unique() to avoid a WARN condition.
This patch has been  used internally for a year.
Comment 1 Prarit Bhargava 2008-10-31 09:14:49 EDT
Hi Keith,

There's no patch attached to this BZ?

Comment 2 keith.d.schincke 2008-10-31 09:24:30 EDT
Created attachment 322051 [details]
Patch to correct problem

I forgot to upload the patch the first time.
Comment 3 keith.d.schincke 2008-11-06 11:00:40 EST
Here is a patch for the kernel spec file for 2.6.9-78.0.5:

--- kernel-2.6.spec.ORIG-2008-11-06-09:12       2008-09-24 04:16:23.000000000 -0500
+++ kernel-2.6.spec     2008-11-06 09:17:27.000000000 -0600
@@ -27,7 +27,7 @@
 # that the kernel isn't the stock distribution kernel, for example by
 # adding some text to the end of the version number.
-%define release 78.0.5.EL
+%define release 78.0.5.EL.LLC
 %define sublevel 9
 %define kversion 2.6.%{sublevel}
 %define rpmversion 2.6.%{sublevel}
@@ -768,6 +768,7 @@
 Patch1334: linux-2.6.9-net-sctp-receive-buffer.patch
 Patch1335: linux-2.6.9-net-sctp.patch
 Patch1336: linux-2.6.9-netfilter.patch
+Patch1337: llc-consolidated.patch
 # NIC driver updates
 Patch1350: linux-2.6.9-net-b44-4g4g.patch
@@ -3073,6 +3074,8 @@
 %patch1335 -p1
 # netfilter updates
 %patch1336 -p1
+# llc consolidated updates
+%patch1337 -p1
 # NIC driver fixes.
 # Fix problems with b44 & 4g/4g
Comment 4 Michal Schmidt 2008-11-28 11:04:05 EST
The patch fixes a BUG in the receiving of fragmented LLC packets. Upstream solved it in http://bugzilla.kernel.org/show_bug.cgi?id=6409 .
The patch consists of several upstream commits:

commit 27b437c8b7d519aac70a0254c2e04c29eff565a2
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Thu Jul 13 19:26:39 2006 -0700

    [NET]: Update frag_list in pskb_trim

commit 3cc0e873986fe594d0e96d07259b11f755325cb2
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Fri Jun 9 16:13:38 2006 -0700

    [NET]: Warn in __skb_trim if skb is paged

commit 5185db09f46ed64d520d09db6e93852e44106628
Author: David S. Miller <davem@sunset.davemloft.net>
Date:   Wed Apr 19 15:37:13 2006 -0700

    [LLC]: Use pskb_trim_rcsum() in llc_fixup_skb().
Comment 5 RHEL Product and Program Management 2008-11-28 11:08:12 EST
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
Comment 6 Michal Schmidt 2008-12-16 21:05:45 EST
Created attachment 327194 [details]
rhel4: fix BUG() in rx of LLC frames in non-linear skbs

This patch was sent to rhkernel-list.
Brew build: https://brewweb.devel.redhat.com/taskinfo?taskID=1616406

I'm uploading the patched kernel-smp for i686 and x86_64 to: http://michich.fedorapeople.org/bz468890/

It would be nice if you could confirm the bug is fixed there. If you'd prefer other kernel flavours and/or archs, let me know.
Comment 7 keith.d.schincke 2008-12-17 11:08:36 EST
My next schedule patch day for this host will be 12/29. I will install the new kernel onto the problem host then.

Thanks for the work!
Comment 8 Michal Schmidt 2008-12-22 11:57:43 EST
Created attachment 327673 [details]
rhel4: fix BUG() in rx of LLC frames in non-linear skbs [v3]

Updated the patch. The difference from the previous version is that this one does not touch the header files.

Brew build: https://brewweb.devel.redhat.com/taskinfo?taskID=1622379

I updated the RPMs at http://michich.fedorapeople.org/bz468890/ with this version.
Comment 9 keith.d.schincke 2008-12-30 17:01:31 EST
This kernel was installed in the problem host on 12/29/2008 at 17:17.

If this kernel runs until Friday with out a mishap, I am willing to call this a good patch for the problem.

Comment 10 keith.d.schincke 2009-01-06 17:27:59 EST
This kernel is working great. 

I look forward to seeing it in a future update.

Comment 11 Vivek Goyal 2009-01-12 09:50:37 EST
Committed in 78.27.EL . RPMS are available at http://people.redhat.com/vgoyal/rhel4/
Comment 14 errata-xmlrpc 2009-05-18 15:32:39 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.