From owner-freebsd-bugs@FreeBSD.ORG  Wed Mar  4 15:14:02 2015
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Delivered-To: freebsd-bugs@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 0238BC5C
 for <freebsd-bugs@FreeBSD.org>; Wed,  4 Mar 2015 15:14:02 +0000 (UTC)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id DBC39118
 for <freebsd-bugs@FreeBSD.org>; Wed,  4 Mar 2015 15:14:01 +0000 (UTC)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t24FE1Fp005565
 for <freebsd-bugs@FreeBSD.org>; Wed, 4 Mar 2015 15:14:01 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-bugs@FreeBSD.org
Subject: [Bug 197535] [re] [panic] if_re (Realtek 8168) causes memory write
 after free and kernel panic
Date: Wed, 04 Mar 2015 15:14:01 +0000
X-Bugzilla-Reason: AssignedTo
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: kern
X-Bugzilla-Version: 11.0-CURRENT
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: Affects Some People
X-Bugzilla-Who: luca.pizzamiglio@gmail.com
X-Bugzilla-Status: New
X-Bugzilla-Priority: ---
X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: mfc-stable10?
X-Bugzilla-Changed-Fields: attachments.created
Message-ID: <bug-197535-8-zXmcguRJ71@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-197535-8@https.bugs.freebsd.org/bugzilla/>
References: <bug-197535-8@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-bugs@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Bug reports <freebsd-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-bugs>,
 <mailto:freebsd-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-bugs/>
List-Post: <mailto:freebsd-bugs@freebsd.org>
List-Help: <mailto:freebsd-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-bugs>,
 <mailto:freebsd-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Mar 2015 15:14:02 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197535

--- Comment #11 from luca.pizzamiglio@gmail.com ---
Created attachment 153780
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=153780&action=edit
patch solving the issue using this hardware

Explanation and solution

The actual problem was that the rx ring (and probably the txring too) wasn't
updated by the driver or, better, the device wasn't able to get these updates.
That explains why the last entry in the ring was ignored and why only few
packets were really copied via DMA.

I found this log entry in the linux git:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d6e572911a4cb2b9fcd1c26a38d5317a3971f2fd

It seems that for "some" chips, Rx and Tx should be enabled in the RL_COMMAND
register later, after rings configuration and so on.

The patch shows only how I used this tip, but I don't know how it could affect
other devices.

-- 
You are receiving this mail because:
You are the assignee for the bug.