Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751444AbbG3F5I (ORCPT ); Thu, 30 Jul 2015 01:57:08 -0400 Received: from szxga02-in.huawei.com ([119.145.14.65]:2490 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750734AbbG3F5G (ORCPT ); Thu, 30 Jul 2015 01:57:06 -0400 From: "Zhangjie (HZ)" To: Eric Dumazet , Jason Wang CC: "linux-kernel@vger.kernel.org" , "mst@redhat.com" , Qinchuanyu , Yewudi , liuyongan 00175866 , "netdev@vger.kernel.org" Subject: RE: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment Thread-Topic: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment Thread-Index: AdDJEs7JxfVbY7PfTLWpLwnjkwizbABKgQsAAAE2ZIAAEo0s0A== Date: Thu, 30 Jul 2015 05:56:40 +0000 Message-ID: <60A73B7A161A82449A7DB7B382BFD1553712F837@SZXEMA504-MBS.china.huawei.com> References: <60A73B7A161A82449A7DB7B382BFD1553712AF1C@SZXEMA504-MBS.china.huawei.com> <55B9A76A.3030908@redhat.com> <1438232461.20182.117.camel@edumazet-glaptop2.roam.corp.google.com> In-Reply-To: <1438232461.20182.117.camel@edumazet-glaptop2.roam.corp.google.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.45.27.33] Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id t6U5vDgI030987 Content-Length: 1896 Lines: 62 Get it. Eric, thanks for your explaination. :-) Jason, thank you! I will remember cc netdev@vger.kernel.org next time. -----Original Message----- From: Eric Dumazet [mailto:eric.dumazet@gmail.com] Sent: Thursday, July 30, 2015 1:01 PM To: Jason Wang Cc: Zhangjie (HZ); linux-kernel@vger.kernel.org; mst@redhat.com; Qinchuanyu; Yewudi; liuyongan 00175866; netdev@vger.kernel.org Subject: Re: [Question]Why a skb with frag_list causes BUG_ON in function skb_segment On Thu, 2015-07-30 at 12:26 +0800, Jason Wang wrote: > cc netdev for more experts > > On 07/28/2015 04:53 PM, Zhangjie (HZ) wrote: > > > > Hi, > > > > I generate a skb as follows: > > > > It has a linear data region, 17 frags and the last fragment is in > > skb_shinfo(skb)->frag_list. > > > > Before this skb is sent to driver, dev_hard_start_xmit() will > > segment it first(skb has frag_list, > > > > so we get true from netif_needs_gso()), then the skb is passed to > > function skb_segment(). > > > > Then, BUG_ON() happened. > > > > while (pos < offset + len) { > > > > if (i >= nfrags) { > > > > BUG_ON(skb_headlen(list_skb)); (skbuff.c:3120) > > > > … > > > > } > > > > … > > > > } > > > > A skb that has no frags but frag_list also causes BUG_ON(). > > > > I wonder if skb like follows is legal? Could skb in frag_list have > > linear data region? The answer is : skb_segment() is very complex but does not handle all possible cases. skb found in skb_shinfo(skb)->frag_list must not have anything in their skb->head. This would require very expensive logic and memory allocations and copies. Make sure you follow this rule in your driver, or even better leave this work to GRO engine. ????{.n?+???????+%?????ݶ??w??{.n?+????{??G?????{ay?ʇڙ?,j??f???h?????????z_??(?階?ݢj"???m??????G????????????&???~???iO???z??v?^?m???? ????????I?