mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
386fd5da40
Running perf in one window to capture tcp_retransmit_skb tracepoint:
$ perf record -e tcp:tcp_retransmit_skb -a
And causing a retransmission on an active TCP session (e.g., dropping
packets in the receiver, changing MTU on the interface to 500 and back
to 1500) triggers a panic:
[ 58.543144] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 58.545300] IP: perf_trace_tcp_retransmit_skb+0xd0/0x145
[ 58.546770] PGD 0 P4D 0
[ 58.547472] Oops: 0000 [#1] SMP
[ 58.548328] Modules linked in: vrf
[ 58.549262] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.0-rc4+ #26
[ 58.551004] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 58.554560] task: ffffffff81a0e540 task.stack: ffffffff81a00000
[ 58.555817] RIP: 0010:perf_trace_tcp_retransmit_skb+0xd0/0x145
[ 58.557137] RSP: 0018:ffff88003fc03d68 EFLAGS: 00010282
[ 58.558292] RAX: 0000000000000000 RBX: ffffe8ffffc0ec80 RCX: ffff880038543098
[ 58.559850] RDX: 0400000000000000 RSI: ffff88003fc03d70 RDI: ffff88003fc14b68
[ 58.561099] RBP: ffff88003fc03da8 R08: 0000000000000000 R09: ffffea0000d3224a
[ 58.562005] R10: ffff88003fc03db8 R11: 0000000000000010 R12: ffff8800385428c0
[ 58.562930] R13: ffffe8ffffc0e478 R14: ffffffff81a93a40 R15: ffff88003d4f0c00
[ 58.563845] FS: 0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
[ 58.564873] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 58.565613] CR2: 0000000000000008 CR3: 000000003d68f004 CR4: 00000000000606f0
[ 58.566538] Call Trace:
[ 58.566865] <IRQ>
[ 58.567140] __tcp_retransmit_skb+0x4ab/0x4c6
[ 58.567704] ? tcp_set_ca_state+0x22/0x3f
[ 58.568231] tcp_retransmit_skb+0x14/0xa3
[ 58.568754] tcp_retransmit_timer+0x472/0x5e3
[ 58.569324] ? tcp_write_timer_handler+0x1e9/0x1e9
[ 58.569946] tcp_write_timer_handler+0x95/0x1e9
[ 58.570548] tcp_write_timer+0x2a/0x58
Check that daddr_cache is non-NULL before de-referencing.
Fixes: e086101b15 ("tcp: add a tracepoint for tcp retransmission")
Signed-off-by: David Ahern <dsahern@gmail.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
68 lines
1.6 KiB
C
68 lines
1.6 KiB
C
#undef TRACE_SYSTEM
|
|
#define TRACE_SYSTEM tcp
|
|
|
|
#if !defined(_TRACE_TCP_H) || defined(TRACE_HEADER_MULTI_READ)
|
|
#define _TRACE_TCP_H
|
|
|
|
#include <linux/ipv6.h>
|
|
#include <linux/tcp.h>
|
|
#include <linux/tracepoint.h>
|
|
#include <net/ipv6.h>
|
|
|
|
TRACE_EVENT(tcp_retransmit_skb,
|
|
|
|
TP_PROTO(struct sock *sk, struct sk_buff *skb),
|
|
|
|
TP_ARGS(sk, skb),
|
|
|
|
TP_STRUCT__entry(
|
|
__field(void *, skbaddr)
|
|
__field(void *, skaddr)
|
|
__field(__u16, sport)
|
|
__field(__u16, dport)
|
|
__array(__u8, saddr, 4)
|
|
__array(__u8, daddr, 4)
|
|
__array(__u8, saddr_v6, 16)
|
|
__array(__u8, daddr_v6, 16)
|
|
),
|
|
|
|
TP_fast_assign(
|
|
struct inet_sock *inet = inet_sk(sk);
|
|
struct in6_addr *pin6;
|
|
__be32 *p32;
|
|
|
|
__entry->skbaddr = skb;
|
|
__entry->skaddr = sk;
|
|
|
|
__entry->sport = ntohs(inet->inet_sport);
|
|
__entry->dport = ntohs(inet->inet_dport);
|
|
|
|
p32 = (__be32 *) __entry->saddr;
|
|
*p32 = inet->inet_saddr;
|
|
|
|
p32 = (__be32 *) __entry->daddr;
|
|
*p32 = inet->inet_daddr;
|
|
|
|
/* IPv6 socket ? */
|
|
if (inet6_sk(sk)) {
|
|
pin6 = (struct in6_addr *)__entry->saddr_v6;
|
|
*pin6 = sk->sk_v6_rcv_saddr;
|
|
pin6 = (struct in6_addr *)__entry->daddr_v6;
|
|
*pin6 = sk->sk_v6_daddr;
|
|
} else {
|
|
pin6 = (struct in6_addr *)__entry->saddr_v6;
|
|
ipv6_addr_set_v4mapped(inet->inet_saddr, pin6);
|
|
pin6 = (struct in6_addr *)__entry->daddr_v6;
|
|
ipv6_addr_set_v4mapped(inet->inet_daddr, pin6);
|
|
}
|
|
),
|
|
|
|
TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c",
|
|
__entry->sport, __entry->dport, __entry->saddr, __entry->daddr,
|
|
__entry->saddr_v6, __entry->daddr_v6)
|
|
);
|
|
|
|
#endif /* _TRACE_TCP_H */
|
|
|
|
/* This part must be outside protection */
|
|
#include <trace/define_trace.h>
|