From patchwork Fri Nov 13 16:49:47 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Timo Teras X-Patchwork-Id: 544371 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 74A7E141434 for ; Sat, 14 Nov 2015 03:49:59 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=YQU2MZDd; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932844AbbKMQtz (ORCPT ); Fri, 13 Nov 2015 11:49:55 -0500 Received: from mail-lb0-f176.google.com ([209.85.217.176]:34005 "EHLO mail-lb0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932444AbbKMQty (ORCPT ); Fri, 13 Nov 2015 11:49:54 -0500 Received: by lbbcs9 with SMTP id cs9so57053677lbb.1 for ; Fri, 13 Nov 2015 08:49:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:subject:message-id:mime-version:content-type :content-transfer-encoding; bh=8aPtsfsrdgLuMMp+5fdkgztONBlhJBklWsblDncLd1Y=; b=YQU2MZDd2oFA3utNHKqDofb4/t7hZYRGV6qSsvHPApoO08rfmEfhhYUr5OXKz54ZJs tHbJC1ruegDrTQkRQttAYaE6xvrtP2aacCo6Z7z1syu8G6gWxHZvoARPyLD1j/2+2Yq6 3xqem9o6uZxwSDrWAgEaSuLCrEr51F6nJ2s9J6BVL/KN+EAnrCqCtZARSl5gfTQ97jWu xEGbpI7RCCGU7EsWPMvtGeeC4QI7Z/zDdjIXP8EXYWfTOd2Vfck9OsjaSFeVI/2EJlc3 mHsSPmcUOMVUlJWq26MR2K2eDCEvviJ6PK+aTZYWSmE1dFrv/XLJNSeXJPo6ZnQkm45W N8FQ== X-Received: by 10.112.200.40 with SMTP id jp8mr10975675lbc.104.1447433392587; Fri, 13 Nov 2015 08:49:52 -0800 (PST) Received: from vostro ([83.145.235.202]) by smtp.gmail.com with ESMTPSA id q8sm1613957lbr.1.2015.11.13.08.49.52 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 13 Nov 2015 08:49:52 -0800 (PST) Date: Fri, 13 Nov 2015 18:49:47 +0200 From: Timo Teras To: Francois Romieu , netdev@vger.kernel.org Subject: via-velocity skb_over_panic Message-ID: <20151113184947.09d57da5@vostro> X-Mailer: Claws Mail 3.13.0 (GTK+ 2.24.28; x86_64-alpine-linux-musl) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi, I recently saw via-velocity skb_over_panic() on one of my locations. The panic happened with two separate hardware devices, so it appears to be network related, not broken hardware. I did not get the actual over_panic printk, as I got only screen shot of them monitor. But the visible part of call trace says: skb_put velocity_poll net_rx_action __do_softirq irq_exit common_interrupt The was recurring every few hours, so I patched via-velocity with the following after looking the code a bit: This seems to have fixed the panics. And I do see one of the NIC's ethtool report's in_range_length_errors increasing once in a while. For some reason I don't see the above debug message though, so I'm not sure on what pkt_len triggers it. In any case, the cade a bit later on does unconditionally: skb_put(skb, pkt_len - 4); So it's possible that some bad packets make the NIC return unexpected packet sizes, and the current code can panic on it. Any suggestions for better fix? Thanks, Timo --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/drivers/net/ethernet/via/via-velocity.c +++ b/drivers/net/ethernet/via/via-velocity.c @@ -2060,6 +2060,11 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx) stats->rx_length_errors++; return -EINVAL; } + if (pkt_len < 4 || pkt_len > vptr->rx.buf_sz) { + VELOCITY_PRT(MSG_LEVEL_VERBOSE, KERN_ERR " %s : the received frame size %d is inconsistent.\n", vptr->netdev->name, pkt_len); + stats->rx_length_errors++; + return -EINVAL; + } if (rd->rdesc0.RSR & RSR_MAR) stats->multicast++;