netdev - Kernel Panic Sending Frames Using dev_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Sep 2013 00:32:55 -0700
From:	Merlin Davis <me.the.wizard@...il.com>
To:	netdev@...r.kernel.org
Subject: Kernel Panic Sending Frames Using dev_queue_xmit()

I am getting kernel panics in the 3.5.0 kernel (and 2.6.39) when
sending Ethernet frames using allocated SKBs passed to
dev_queue_xmit() from a kernel module.  I have trimmed the problem to
a very small module that continually sends the same (captured and
verified) frame from one net_device.  The frames are sent without a
socket in I believe the same way that net/ipv4/arp.c creates and sends
them.  The panic can occur after a few seconds or a few minutes, but
always occurs.  It is USUALLY a "kernel NULL pointer dereference" and
USUALLY occurs within __kfree_skb(), but both the error and the
location can vary.  I have not been successful in capturing a complete
oops message.

There is a GitHub repository with the module, a makefile, and more
notes about how I have tested and what I have tried at
https://github.com/me-the-wizard/ksend

I do not know if there is something I am doing wrong with the SKBs or
if I have stumbled upon a bug in the kernel.  After weeks of attempts
I believe I have reached the limit of my ability to figure this out.
Can anyone offer some guidance?

Thank you,
Merlin
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html