netdev - Re: r8169 OOPSen in rtl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 14 Aug 2013 11:29:15 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Francois Romieu <romieu@...zoreil.com>
Cc:	nic_swsd@...ltek.com, netdev@...r.kernel.org
Subject: Re: r8169 OOPSen in rtl_rx

On Tue, Aug 13, 2013 at 11:15:34PM +0200, Francois Romieu wrote:
> Peter Zijlstra <peterz@...radead.org> :
> [...]
> > I've got an AMD x86_64 machine with two realtek NICs:
> > 
> > 01:08.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8169 Gigabit Ethernet (rev 10)
> > 03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller (rev 06)
> 
> Which XID (see kernel dmesg) ?

$ dmesg | grep -i xid
[    1.706427] r8169 0000:01:08.0 eth0: RTL8110s at 0xffffc9000063ac00, 00:0e:2e:87:8b:70, XID 04000000 IRQ 18
[    1.717012] r8169 0000:03:00.0 eth1: RTL8168e/8111e at 0xffffc90000646000, a0:f3:c1:00:74:a3, XID 0c200000 IRQ 43

> > So all I've got to offer currently is a partial backtrace -- see
> > attached image.
> 
> (no attachment)

Oh, duh.. 

> > Partial transcribe:
> > 
> >   ? rtl8169_try_rx_copy.isra.77
> 
> /me scratches head.
> 
> You may check that pkt_size is > 0, <= ETH_FRAME_LEN (no jumbo ?) and
> see if it helps.

So eth0 runs at 1000Mb/s but has a MTU:1500, eth1 runs at 100Mb/s also
MTU:1500.

I'll try a kernel with the below. Hopefully the change in dumpstack_64.c
will avoid printing the 'process' stack and give a little more useful
information.

Will let you know.

Thanks

---
 arch/x86/kernel/dumpstack_64.c       | 7 ++++---
 drivers/net/ethernet/realtek/r8169.c | 2 ++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index addb207..f76e98f 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -182,7 +182,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
 				stack = (unsigned long *) (irq_stack_end[-1]);
 				irq_stack_end = NULL;
 				ops->stack(data, "EOI");
-				continue;
+				goto out;
 			}
 		}
 		break;
@@ -192,6 +192,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
 	 * This handles the process stack:
 	 */
 	bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
+out:
 	put_cpu();
 }
 EXPORT_SYMBOL(dump_trace);
@@ -231,8 +232,8 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
 				pr_cont(" <EOI> ");
 			}
 		} else {
-		if (((long) stack & (THREAD_SIZE-1)) == 0)
-			break;
+			if (((long) stack & (THREAD_SIZE-1)) == 0)
+				break;
 		}
 		if (i && ((i % STACKSLOTS_PER_LINE) == 0))
 			pr_cont("\n");
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 393f961..76d1c18 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6185,6 +6185,8 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
 			else
 				pkt_size = status & 0x00003fff;
 
+			WARN_ON(!(pkt_size > 0 && pkt_size <= ETH_FRAME_LEN));
+
 			/*
 			 * The driver does not support incoming fragmented
 			 * frames. They are seen as a symptom of over-mtu

Download attachment "IMG_20130810_195601.jpg" of type "image/jpeg" (301515 bytes)