From owner-freebsd-net@freebsd.org Thu Jan 16 11:52:58 2020 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 385E6234250 for ; Thu, 16 Jan 2020 11:52:58 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.nyi.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id 47z2d60pphz3P7k for ; Thu, 16 Jan 2020 11:52:58 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 1A24923424F; Thu, 16 Jan 2020 11:52:58 +0000 (UTC) Delivered-To: net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 19EAF23424E for ; Thu, 16 Jan 2020 11:52:58 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47z2d572ssz3P7j for ; Thu, 16 Jan 2020 11:52:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id ED4D31F03A for ; Thu, 16 Jan 2020 11:52:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 00GBqvjB057389 for ; Thu, 16 Jan 2020 11:52:57 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 00GBqvRl057388 for net@FreeBSD.org; Thu, 16 Jan 2020 11:52:57 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 240608] if_vmx(4): iflib - Panic with INVARIANTS: Memory modified after free (12.1-pre-QA) Date: Thu, 16 Jan 2020 11:52:57 +0000 X-Bugzilla-Reason: AssignedTo CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 12.0-STABLE X-Bugzilla-Keywords: crash, needs-qa X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: avg@FreeBSD.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: net@FreeBSD.org X-Bugzilla-Flags: mfc-stable12? mfc-stable11? X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jan 2020 11:52:58 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D240608 --- Comment #14 from Andriy Gapon --- As to why the hardware can exhaust all descriptors in a free list. I think that there is a certain impedance mismatch. iflib_rxeof() takes its budget in terms of full packets and also iflib_rxd_avail() works in the same terms. __iflib_fl_refill_lt() is called with a limit equal to budget + 8.=20 But the descriptors are used by packet fragments and a single packet may ha= ve many fragments. Also, a driver like vmx may waste some descriptors[*] for reasons that are known only to vmware. For example, in one crash dumps that I have here I see that iflib_rxeof() w= as processing its 11th packet (rx_pkts =3D 11, avail =3D 7, budget =3D 16) and= that packet had iri_nfrags =3D 14. It's conceivable that such a batch could exhaust all descriptors populated = by the last refill. [*] eop=3D1, sop=3D1, len=3D0 but a command descriptor 141 in rx queue 0 is "co= nsumed": (kgdb) p $19.vxcr_u.rxcd[475] $22 =3D {rxd_idx =3D 141, pad1 =3D 0, eop =3D 1, sop =3D 1, qid =3D 0, rss_= type =3D 0, no_csum =3D 0, pad2 =3D 0, rss_hash =3D 0, len =3D 0, error =3D 0, vlan =3D= 0, vtag =3D 0, csum =3D 0, csum_ok =3D 0, udp =3D 0, tcp =3D 0, ipcsum_ok =3D 0, ipv6 =3D = 0, ipv4 =3D 0, fragment =3D 0, fcs =3D 0, type =3D 3, gen =3D 1} --=20 You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug.=