netdev - stmmac and XDP/ZC issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 20 Feb 2024 12:02:25 +0100
From: Kurt Kanzenbach <kurt@...utronix.de>
To: netdev@...r.kernel.org
Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Song Yoong Siang
 <yoong.siang.song@...el.com>
Subject: stmmac and XDP/ZC issue

Hello netdev community,

after updating to v6.8 kernel I've encountered an issue in the stmmac
driver.

I have an application which makes use of XDP zero-copy sockets. It works
on v6.7. On v6.8 it results in the stack trace shown below. The program
counter points to:

 - ./include/net/xdp_sock.h:192 and
 - ./drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:2681

It seems to be caused by the XDP meta data patches. This one in
particular 1347b419318d ("net: stmmac: Add Tx HWTS support to XDP ZC").

To reproduce:

 - Hardware: imx93
 - Run ptp4l/phc2sys
 - Configure Qbv, Rx steering, NAPI threading
 - Run my application using XDP/ZC on queue 1

Any idea what might be the issue here?

Thanks,
Kurt

Stack trace:

|[  169.248150] imx-dwmac 428a0000.ethernet eth1: configured EST
|[  191.820913] imx-dwmac 428a0000.ethernet eth1: EST: SWOL has been switched
|[  226.039166] imx-dwmac 428a0000.ethernet eth1: entered promiscuous mode
|[  226.203262] imx-dwmac 428a0000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0
|[  226.203753] imx-dwmac 428a0000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-1
|[  226.303337] imx-dwmac 428a0000.ethernet eth1: Register MEM_TYPE_XSK_BUFF_POOL RxQ-1
|[  255.822584] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
|[  255.822602] Mem abort info:
|[  255.822604]   ESR = 0x0000000096000044
|[  255.822608]   EC = 0x25: DABT (current EL), IL = 32 bits
|[  255.822613]   SET = 0, FnV = 0
|[  255.822616]   EA = 0, S1PTW = 0
|[  255.822618]   FSC = 0x04: level 0 translation fault
|[  255.822622] Data abort info:
|[  255.822624]   ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
|[  255.822627]   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
|[  255.822630]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
|[  255.822634] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000085fe1000
|[  255.822638] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
|[  255.822650] Internal error: Oops: 0000000096000044 [#1] PREEMPT_RT SMP
|[  255.822655] Modules linked in:
|[  255.822660] CPU: 0 PID: 751 Comm: napi/eth1-261 Not tainted 6.8.0-rc4-rt4-00100-g9c63d995ca19 #8
|[  255.822666] Hardware name: NXP i.MX93 11X11 EVK board (DT)
|[  255.822669] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
|[  255.822674] pc : stmmac_tx_clean.constprop.0+0x848/0xc38
|[  255.822690] lr : stmmac_tx_clean.constprop.0+0x844/0xc38
|[  255.822696] sp : ffff800085ec3bc0
|[  255.822698] x29: ffff800085ec3bc0 x28: ffff000005b609e0 x27: 0000000000000001
|[  255.822706] x26: 0000000000000000 x25: ffff000005b60ae0 x24: 0000000000000001
|[  255.822712] x23: 0000000000000001 x22: ffff000005b649e0 x21: 0000000000000000
|[  255.822719] x20: 0000000000000020 x19: ffff800085291030 x18: 0000000000000000
|[  255.822725] x17: ffff7ffffc51c000 x16: ffff800080000000 x15: 0000000000000008
|[  255.822732] x14: ffff80008369b880 x13: 0000000000000000 x12: 0000000000008507
|[  255.822738] x11: 0000000000000040 x10: 0000000000000a70 x9 : ffff800080e32f84
|[  255.822745] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000003ff0
|[  255.822751] x5 : 0000000000003c40 x4 : ffff000005b60000 x3 : 0000000000000000
|[  255.822757] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
|[  255.822764] Call trace:
|[  255.822766]  stmmac_tx_clean.constprop.0+0x848/0xc38
|[  255.822772]  stmmac_napi_poll_rxtx+0xc4/0xec0
|[  255.822778]  __napi_poll.constprop.0+0x40/0x220
|[  255.822785]  napi_threaded_poll+0xd8/0x228
|[  255.822790]  kthread+0x108/0x120
|[  255.822798]  ret_from_fork+0x10/0x20
|[  255.822808] Code: 910303e0 f9003be1 97ffdec0 f9403be1 (f9000020) 
|[  255.822812] ---[ end trace 0000000000000000 ]---
|[  255.822817] Kernel panic - not syncing: Oops: Fatal exception in interrupt
|[  255.822819] SMP: stopping secondary CPUs
|[  255.822827] Kernel Offset: disabled
|[  255.822829] CPU features: 0x0,c0000000,4002814a,2100720b
|[  255.822834] Memory Limit: none
|[  256.062429] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---

Download attachment "signature.asc" of type "application/pgp-signature" (862 bytes)