linux-kernel - Re: Kernel Panic in skb_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <483c73edf02fa0139aae2b81e797534817655ea0.camel@kernel.org>
Date:   Tue, 01 Jun 2021 11:33:18 +0200
From:   nicolas saenz julienne <nsaenz@...nel.org>
To:     Florian Fainelli <f.fainelli@...il.com>,
        Maxime Ripard <maxime@...no.tech>
Cc:     Doug Berger <opendmb@...il.com>,
        bcm-kernel-feedback-list@...adcom.com,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: Kernel Panic in skb_release_data using genet

On Mon, 2021-05-31 at 19:36 -0700, Florian Fainelli wrote:
> > That is also how I boot my Pi4 at home, and I suspect you are right, if
> > the VPU does not shut down GENET's DMA, and leaves buffer addresses in
> > the on-chip descriptors that point to an address space that is managed
> > totally differently by Linux, then we can have a serious problem and
> > create some memory corruption when the ring is being reclaimed. I will
> > run a few experiments to test that theory and there may be a solution
> > using the SW_INIT reset controller to have a big reset of the controller
> > before handing it over to the Linux driver.
> 
> Adding a WARN_ON(reg & DMA_EN) in bcmgenet_dma_disable() has not shown
> that the TX or RX DMA have been left running during the hand over from
> the VPU to the kernel. I checked out drm-misc-next-2021-05-17 to reduce
> as much as possible the differences between your set-up and my set-up
> but so far have not been able to reproduce the crash in booting from NFS
> repeatedly, I will try again.

FWIW I can reproduce the error too. That said it's rather hard to reproduce,
something in the order of 1 failure every 20 tries.

Regards,
Nicolas