Bug 702508
| Summary: | TCP traffic to IPv6 causes 32 bit Linux OS to reboot | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Atita <atita.shirwaikar> |
| Component: | kernel | Assignee: | Jiri Olsa <jolsa> |
| Status: | CLOSED ERRATA | QA Contact: | Botu Sun <bosun> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.0 | CC: | agospoda, alexander.h.duyck, bosun, dtian, haliu, jesse.brandeburg, kmcmartin, nhorman |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kernel-2.6.32-164.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-06 13:22:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Atita
2011-05-05 22:10:26 UTC
Just to clarify, this bug only happens if you use the out of tree driver, correct? Can you reproduce it with the shipping driver? Correct.It does not happen with the shipped driver. Well, as you note we don't support the out of tree driver, and the panic is clearly occurring inside that code. We might backport whatever change is causing this, but only after you get it fixed. What exactly are you asking us to do here? If the patch is already upstream of if you have the patch that you plan to post upstream that will likely cause this to happen with a backported driver, please attach it to the bug so we can test. Thanks! Since RHEL 6.1 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. This panic has been root caused to the fact that the driver is being passed IPv6 SKBs for transmit that have an uninitialized transport header. We do not see the same problem with the linux-2.6 kernel and are still trying to determine what patch resolved this issue. I believe the kernel is likely missing the patch below which is causing the issues we are seeing: From: Herbert Xu <herbert.org.au> Date: Wed, 21 Apr 2010 07:47:15 +0000 (-0700) Subject: ipv6: Fix tcp_v6_send_response transport header setting. X-Git-Tag: v2.6.34-rc6~30^2~18 X-Git-Url: http://gitlad.jf.intel.com/git/?p=torvalds%2Flinux-2.6%2F.git;a=commitdiff_plain;h=6651ffc8e8bdd5fb4b7d1867c6cfebb4f309512c ipv6: Fix tcp_v6_send_response transport header setting. My recent patch to remove the open-coded checksum sequence in tcp_v6_send_response broke it as we did not set the transport header pointer on the new packet. Actually, there is code there trying to set the transport header properly, but it sets it for the wrong skb ('skb' instead of 'buff'). This bug was introduced by commit a8fdf2b331b38d61fb5f11f3aec4a4f9fb2dedcb ("ipv6: Fix tcp_v6_send_response(): it didn't set skb transport header") Signed-off-by: Herbert Xu <herbert.org.au> Signed-off-by: David S. Miller <davem> --- diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index c92ebe8..075f540 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1015,7 +1015,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win, skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len); t1 = (struct tcphdr *) skb_push(buff, tot_len); - skb_reset_transport_header(skb); + skb_reset_transport_header(buff); /* Swap the send and the receive. */ memset(t1, 0, sizeof(*t1)); I understand the issue is not reproducible without the out of tree ixgbe driver. I port the patch from Comment 8, and rpms are published here: http://people.redhat.com/jolsa/702508/ Could you please make the test and let me know? thanks We added a workaround to the out-of-tree driver that is essentially masking the issue but it doesn't solve it. We are checking for null pointer and on 32 bit systems this is okay, but it doesn't resolve the issue on 64 bit systems. On 64bit systems this issue doesn't cause a panic. Instead an invalid hash will be generated and issued to the hardware that will have no effect. The fix I mentioned in comment 8 will resolve the issue for both 64 and 32 bit so that it is resolved in both cases. This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release. Patch(es) available on kernel-2.6.32-164.el6 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1530.html |