diff mbox

r8169 OOPSen in rtl_rx

Message ID 20130814095233.GH24092@twins.programming.kicks-ass.net
State RFC, archived
Delegated to: David Miller
Headers show

Commit Message

Peter Zijlstra Aug. 14, 2013, 9:52 a.m. UTC 
On Wed, Aug 14, 2013 at 11:29:15AM +0200, Peter Zijlstra wrote:
> diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
> index 393f961..76d1c18 100644
> --- a/drivers/net/ethernet/realtek/r8169.c
> +++ b/drivers/net/ethernet/realtek/r8169.c
> @@ -6185,6 +6185,8 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
>  			else
>  				pkt_size = status & 0x00003fff;
>  
> +			WARN_ON(!(pkt_size > 0 && pkt_size <= ETH_FRAME_LEN));
> +
>  			/*
>  			 * The driver does not support incoming fragmented
>  			 * frames. They are seen as a symptom of over-mtu

OK, I changed that to:

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Peter Zijlstra Sept. 5, 2013, 3:20 p.m. UTC | #1 
On Wed, Aug 14, 2013 at 11:52:33AM +0200, Peter Zijlstra wrote:
> diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
> index 393f961..81e0bf4 100644
> --- a/drivers/net/ethernet/realtek/r8169.c
> +++ b/drivers/net/ethernet/realtek/r8169.c
> @@ -6185,6 +6185,12 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
>  			else
>  				pkt_size = status & 0x00003fff;
>  
> +			if (!(pkt_size > 0 && pkt_size <= ETH_FRAME_LEN)) {
> +				dev->stats.rx_dropped++;
> +				printk("%s Funny sized packet: %d\n", dev->name, pkt_size);
> +				goto release_descriptor;
> +			}
> +
>  			/*
>  			 * The driver does not support incoming fragmented
>  			 * frames. They are seen as a symptom of over-mtu

Yay, it triggered..

$ dmesg | awk '/Funny sized packet/ { t[$6]++ } END { for (i in t) {
printf "%d %d\n", t[i], i; } }' | sort -n
1 4237
1 4983
1 5811
1 6062
1 6594
2 10709
2 12073
2 9197
4 14624
4 14870
266 16364

dev->name is always the same and the internal NIC (eth0, RTL8110s).

When it happens the NIC stops working as every packet is mal-sized,
however an ifconfig down; ifconfig up will restore it to working order.

It appears to happen when I saturate my outside link such that all
packets are fwd to the internal network -- I've got a 30Mbit/s down link
which isn't all that much given its a GBE capable card.

When I try and saturate the internal nic, with traffic from the firewall
to an internal machine we reach GBE speeds but nothing falls over.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Francois Romieu Sept. 5, 2013, 11:09 p.m. UTC | #2 
Peter Zijlstra <peterz@infradead.org> :
[...]
> Yay, it triggered..

Bingo.

Can you display the whole descriptor entry (opts1 and opts2) and its
index (cur_rx) when abnormal packets are detected ?
We can always check the packet size but I'd welcome some more specific
pattern in the remaining bits of the descriptor.

Btw, you may try to revert aee77e4accbeb2c86b1d294cd84fec4a12dde3bd
("r8169: use unlimited DMA burst for TX") and see if it changes the
Rx / Tx balance. It would only be a bandaid though.
diff mbox

Patch

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 393f961..81e0bf4 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -6185,6 +6185,12 @@  static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
 			else
 				pkt_size = status & 0x00003fff;
 
+			if (!(pkt_size > 0 && pkt_size <= ETH_FRAME_LEN)) {
+				dev->stats.rx_dropped++;
+				printk("%s Funny sized packet: %d\n", dev->name, pkt_size);
+				goto release_descriptor;
+			}
+
 			/*
 			 * The driver does not support incoming fragmented
 			 * frames. They are seen as a symptom of over-mtu