netdev - Re: [E1000-devel] Crash in e1000e, 3.3.8+ (tainted)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Jul 2012 16:20:56 -0700
From:	Ben Greear <greearb@...delatech.com>
To:	"Dave, Tushar N" <tushar.n.dave@...el.com>
CC:	e1000-devel list <e1000-devel@...ts.sourceforge.net>,
	netdev <netdev@...r.kernel.org>, bruce.w.allan@...el.com
Subject: Re: [E1000-devel] Crash in e1000e, 3.3.8+ (tainted)

On 07/24/2012 04:13 PM, Dave, Tushar N wrote:
>> -----Original Message-----
>> From: Ben Greear [mailto:greearb@...delatech.com]
>> Sent: Tuesday, July 24, 2012 2:46 PM
>> To: e1000-devel list; netdev
>> Subject: [E1000-devel] Crash in e1000e, 3.3.8+ (tainted)
>>
>> We have a somewhat reproducible crash using a 6-port NIC with 3.3.8+
>> kernel.  This kernel is tainted with a proprietary module, but the module
>> is not in use.
>>
>> The rx-all and related patches that were later accepted upstream have been
>> applied to this kernel.
>>
>> It seems that buffer_info is NULL in the code below?
>>
>>
>> (gdb) list e1000_alloc_rx_buffers+0x5b
>> Junk at end of line specification.
>> (gdb) list *(e1000_alloc_rx_buffers+0x5b)
>> 0x15822 is in e1000_alloc_rx_buffers (/home/greearb/git/linux-
>> 3.3.dev.y/drivers/net/ethernet/intel/e1000e/netdev.c:611).
>> 606
>> 607		i = rx_ring->next_to_use;
>> 608		buffer_info = &rx_ring->buffer_info[i];
>> 609
>> 610		while (cleaned_count--) {
>> 611			skb = buffer_info->skb;
>> 612			if (skb) {
>> 613				skb_trim(skb, 0);
>> 614				goto map_skb;
>> 615			}
>> (gdb)
>>
>>
> Ben,
>
> This looks familiar to me, I believe this is due to race between adapter reset and e1000_close.
> Let me check if we have fix upstream or not.

I'm testing Bruce Allen's suggestion now:  bb9e44d0 (from 3.4).

It applies with fuzz to my 3.3.8+ tree.

So far, so good...but need to do some more reboots to be sure.

Thanks,
Ben

-- 
Ben Greear <greearb@...delatech.com>
Candela Technologies Inc  http://www.candelatech.com



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html