[prev in list] [next in list] [prev in thread] [next in thread] 

List:       user-mode-linux-user
Subject:    Re: [uml-user] Kernel panic when using NS-2 and UML//TAP devices/ebtables
From:       Blaisorblade <blaisorblade () yahoo ! it>
Date:       2005-12-23 16:14:31
Message-ID: 200512231714.32102.blaisorblade () yahoo ! it
[Download RAW message or body]

On Friday 23 December 2005 15:12, Fuad Abinader Jr wrote:
> Hi all,

>    I'm going to describe here what's happening with me for some months, and
> if someone have an idea, please help me!

I've briefly looked through your setup... I've briefly answered some of your 
questions at the end, but I also suggest redirecting this question to the 
network code Linux developers.

>     Now, I'll describe my problem: when I apply CRTP header compression
> inside NS-2 AND use an error greater enougth to generate packet drops, a
> kernel panic occurs; however, if I use CRTP header compression BUT NO error
> e.g. no packet drops, nothing happens. It's important to note that the CRTP
> header compression only occurs inside NS-2; never the Ethernet interfaces
> at the UML terminals receive compressed packets, only restored ones.
>    The kernel crash dump indicates "Kernel BUG at net/core/skbuf.c:112!
> Invalid operand: 0000 [*1]". It also indicates that the process was nse
> (the NS-2 emulation application), and the call trace indicates that the
> last methods called were br_dev_queue_push_xmit[bridge] and
> br_forward_finish[bridge].

If possible, posting rather than describing the crash dump would be more 
useful - there *is* indeed some missing info. Excerpt where you're getting 
the bug:

void skb_under_panic(struct sk_buff *skb, int sz, void *here)
{
        printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p "
                          "data:%p tail:%p end:%p dev:%s\n",
               here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end,
               skb->dev ? skb->dev->name : "<NULL>");
        BUG();
}

>    I've already noted that skbuf.c defines the kernel socket buffer, which
> is stated as the kernel structure used to exchange the packets between
> network layers. So, if as the kernel dump states, the BUG occurred inside
> the bridge (when called by the nse process), I suppose the error occurs
> when the NS-2 forwards back the packet to the destination interface. So, my
> questions are:

> [to uml users] a) Is there any known bug/limitation associated to ebtable
> FORWARD rules, or the Ethernet bridges, when associated to UML terminals?

The UML code does very little which is network related - especially in this 
context.

The main difference with another host is that while on a normal host you'd get 
a Oops (i.e. the process calling into the kernel and getting there killed, 
with a nice message in kernel logs), on UML we've found a better policy to 
make even Oops halt the kernel, instead of allowing the kernel to keep 
running in spike of some critical error.

Indeed, unless otherwise proved, I'd assume it's a bridge-code related bug, 
and that probably should be reported to network developers. Here there's 
nobody hanging around able to diagnose it thoroughly.

>  [to all]       b) Is it possible that a process (nse) running in user mode
> causes a kernel panic when it seems to be just sending packets?

This shouldn't happen, in fact it's called a kernel bug, and it can even be a 
local Denial of Service (don't know if this particular one can be exploited) 
and gets reported to Bugtraq and such.

> [to nse users] c) Is it possible that the NSE module causes this kernel
> panic when sending back the packet to the interfaces, by calling the socket
> sending method

Possibly the code is getting confused by some odd condition, yes.

> with odd length values? 

This isn't the only possible condition, for instance fragmented packets are 
often difficult to reassemble correctly.

> P.S.: Sorry for the long error description, but I needed to describe the
> scenario and the problem :p

-- 
Inform me of my mistakes, so I can keep imitating Homer Simpson's "Doh!".
Paolo Giarrusso, aka Blaisorblade (Skype ID "PaoloGiarrusso", ICQ 215621894)
http://www.user-mode-linux.org/~blaisorblade

	

	
		
___________________________________ 
Yahoo! Mail: gratis 1GB per i messaggi e allegati da 10MB 
http://mail.yahoo.it



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
User-mode-linux-user mailing list
User-mode-linux-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-user
[prev in list] [next in list] [prev in thread] [next in thread]