From: "Michał Mirosław" <mirq-linux@rere.qmqm.pl>
To: Jon Hunter <jonathanh@nvidia.com>
Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>,
Alexandre Torgue <alexandre.torgue@foss.st.com>,
Jose Abreu <joabreu@synopsys.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
linux-tegra <linux-tegra@vger.kernel.org>,
Thierry Reding <treding@nvidia.com>
Subject: Re: [BUG] net: stmmac: Panic observed in stmmac_napi_poll_rx()
Date: Fri, 14 May 2021 23:49:27 +0200 [thread overview]
Message-ID: <20210514214927.GC1969@qmqm.qmqm.pl> (raw)
In-Reply-To: <b0b17697-f23e-8fa5-3757-604a86f3a095@nvidia.com>
On Fri, May 14, 2021 at 03:24:58PM +0100, Jon Hunter wrote:
> Hello!
>
> I have been looking into some random crashes that appear to stem from
> the stmmac_napi_poll_rx() function. There are two different panics I
> have observed which are ...
[...]
> The bug being triggered in skbuff.h is the following ...
>
> void *skb_pull(struct sk_buff *skb, unsigned int len);
> static inline void *__skb_pull(struct sk_buff *skb, unsigned int len)
> {
> skb->len -= len;
> BUG_ON(skb->len < skb->data_len);
> return skb->data += len;
> }
>
> Looking into the above panic triggered in skbuff.h, when this occurs
> I have noticed that the value of skb->data_len is unusually large ...
>
> __skb_pull: len 1500 (14), data_len 4294967274
[...]
The big value looks suspiciously similar to (unsigned)-EINVAL.
> I then added some traces to stmmac_napi_poll_rx() and
> stmmac_rx_buf2_len() to trace the values of various various variables
> and when the problem occurs I see ...
>
> stmmac_napi_poll_rx: stmmac_rx: count 0, len 1518, buf1 66, buf2 1452
> stmmac_napi_poll_rx: stmmac_rx_buf2_len: len 66, plen 1518
> stmmac_napi_poll_rx: stmmac_rx: count 1, len 1518, buf1 66, buf2 1452
> stmmac_napi_poll_rx: stmmac_rx_buf2_len: len 66, plen 1536
> stmmac_napi_poll_rx: stmmac_rx: count 2, len 1602, buf1 66, buf2 1536
> stmmac_napi_poll_rx: stmmac_rx_buf2_len: len 1602, plen 1518
> stmmac_napi_poll_rx: stmmac_rx: count 2, len 1518, buf1 0, buf2 4294967212
> stmmac_napi_poll_rx: stmmac_rx: dma_buf_sz 1536, buf1 0, buf2 4294967212
And this one to (unsigned)-EILSEQ.
> Note I added the above BUG_ON to trap unusually large buffers. Let
> me know if you have any thoughts.
Do above ring any bell?
Best Regards
Michał Mirosław
next prev parent reply other threads:[~2021-05-14 21:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-14 14:24 [BUG] net: stmmac: Panic observed in stmmac_napi_poll_rx() Jon Hunter
2021-05-14 21:49 ` Michał Mirosław [this message]
2021-05-17 10:39 ` Jon Hunter
2021-05-24 12:48 ` Mikko Perttunen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210514214927.GC1969@qmqm.qmqm.pl \
--to=mirq-linux@rere.qmqm.pl \
--cc=alexandre.torgue@foss.st.com \
--cc=joabreu@synopsys.com \
--cc=jonathanh@nvidia.com \
--cc=linux-tegra@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=peppe.cavallaro@st.com \
--cc=treding@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).