From owner-freebsd-net@FreeBSD.ORG  Fri May 22 09:48:36 2015
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 3FD8FC9
 for <freebsd-net@FreeBSD.org>; Fri, 22 May 2015 09:48:36 +0000 (UTC)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 2892A1B03
 for <freebsd-net@FreeBSD.org>; Fri, 22 May 2015 09:48:36 +0000 (UTC)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t4M9mab9014372
 for <freebsd-net@FreeBSD.org>; Fri, 22 May 2015 09:48:36 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-net@FreeBSD.org
Subject: [Bug 148807] [panic] 8.1-RELEASE/10.1-STABLE "panic: sbdrop" and
 "panic: sbsndptr: sockbuf _ and mbuf _ clashing"
Date: Fri, 22 May 2015 09:48:36 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: kern
X-Bugzilla-Version: 10.1-STABLE
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: Affects Only Me
X-Bugzilla-Who: sebastian.huber@embedded-brains.de
X-Bugzilla-Status: Open
X-Bugzilla-Priority: Normal
X-Bugzilla-Assigned-To: freebsd-net@FreeBSD.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-148807-2472-W4zzHMYEdr@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-148807-2472@https.bugs.freebsd.org/bugzilla/>
References: <bug-148807-2472@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 22 May 2015 09:48:36 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=148807

--- Comment #19 from sebastian.huber@embedded-brains.de ---
(In reply to sebastian.huber from comment #18)
I found one problem with the driver.  In the RTEMS port of the network stack I
don't use the BUS_DMA(9) support and instead directly use cache
invalidate/flush routines (the Altera Cyclone V has no automatic cache
coherency between the Ethernet module and the processors).  In the receive path
it was done like this:

invalidate buffer (mcluster)
register buffer in receive DMA descriptor
...
DMA done
hand over buffer to interface input

It seems that due to a cache line prefetch sometimes cache lines of the buffer
are loaded to the cache after the invalidate, but before the receive DMA
completed its transfers.

I changed the sequence like this:

invalidate buffer (mcluster)
register buffer in receive DMA descriptor
...
DMA done
invalidate buffer
hand over buffer to interface input

Now it works very stable and I didn't observe a mbuf or socketbuf corruption
any more.

So as an off hand guess it seems in case the network stack is presented with
partially invalid data (previously received IP and TCP headers mixed with new
data most likely), then this could lead to a crash in the TCP input processing.

-- 
You are receiving this mail because:
You are the assignee for the bug.