From owner-freebsd-bugs@FreeBSD.ORG Sun Feb 15 00:00:59 2015 Return-Path: Delivered-To: freebsd-bugs@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id ED3BC867 for ; Sun, 15 Feb 2015 00:00:59 +0000 (UTC) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id D225F883 for ; Sun, 15 Feb 2015 00:00:59 +0000 (UTC) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t1F00x54053824 for ; Sun, 15 Feb 2015 00:00:59 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 197535] [re] [panic] if_re (Realtek 8168) causes memory write after free and kernel panic Date: Sun, 15 Feb 2015 00:00:59 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 11.0-CURRENT X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: marius@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: mfc-stable10? X-Bugzilla-Changed-Fields: attachments.created Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Feb 2015 00:01:00 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197535 --- Comment #4 from Marius Strobl --- Created attachment 152990 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=152990&action=edit re_cfgv2.diff You could give this patch a try (note that the location of if_rlreg.h depends on the version of FreeBSD). If fixes a couple of bugs, mainly in the area of receiver configuration of newer chips. Given that these configuration bits got repurposed and it's unknown what both the old and new bits do exactly in later MACs, this patch might make a difference for you. That said, generally your problem appears to be caused by a hardware defect of some sort. For one, rev. 0x4c000000 chips are known to work at this time. Also, the memory used for descriptors shouldn't suddenly go away and cause a page fault when accessed. Moreover, the freed memory neither containing the expected 0xdeadc0de nor some random bits but just always all ones in your case is very suspicious. Have you tested whether that piece of hardware works with Linux? -- You are receiving this mail because: You are the assignee for the bug.