Wind River Support Network

HomeDefectsLIN6-4406
Not to be fixed

LIN6-4406 : DPAA skb buffer overflow

Created: Aug 11, 2013    Updated: Apr 19, 2018
Resolved Date: Apr 17, 2018
Previous ID: LIN4-7444
Found In Version: 6.0
Severity: Critical
Applicable for: Wind River Linux 6
Component/s: BSP

Description

When receiving large packets, dpaa skb buffer will overflow.
skb_over_panic: text:c041416c len:1678 put:1678 head:c4ce1000 data:c4ce1020 tail:0xc4ce16ae end:0xc4ce1680 dev:<NULL>
------------[ cut here ]------------
kernel BUG at /usr1/p3041_prj/build/linux/net/core/skbuff.c:127!
Oops: Exception in kernel mode, sig: 5 [#1]
PREEMPT SMP NR_CPUS=4 LTT NESTING LEVEL : 0 
P3041 DS
last sysfs file: /sys/devices/virtual/net/B_BOND/bonding/slaves
Modules linked in: mtd kkmtdchar mtd_blkdevs mtdblock mtdconcat jffs2 cfi_util chipreg gen_probe cfi_probe cfi_cmdset_0002 cfi_cmdset_0001 cfi_cmdset_0020 ofpart physmap_of m25p80 ubi kkecc kkcpld kkwatchdog kkled kkfpga kkframe kkbonding kkphy kkcpureg kkclt kkdma kkEthDrvCntShow kktop kklsbox kkdsp ddrramdriver dl_kbox kkalg
NIP: c04da210 LR: c04da210 CTR: c0417f7c
REGS: cf065c60 TRAP: 0700   Not tainted  (2.6.34.13-WR4.3.0.0_standard)
MSR: 00029002 <EE,ME,CE>  CR: 42004044  XER: 00000000
TASK = cf058b00[0] 'swapper' THREAD: cf064000 CPU: 1
GPR00: c04da210 cf065d10 cf058b00 0000007c 00021002 ffffffff c034278c 00000000 
GPR08: 00000000 00000004 0000000a 017c3000 22004044 00000000 c078e690 00000001 
GPR16: c08927a4 cf064000 c075a004 c079b5c0 c078e700 c078e620 ffffffff 00000000 
GPR24: 000000a0 cf3cfdf0 04ce1080 c088ec24 c473b600 d1091040 cf3ed000 c4ce1020 
NIP [c04da210] skb_over_panic+0x48/0x5c
LR [c04da210] skb_over_panic+0x48/0x5c
Call Trace:
[cf065d10] [c04da210] skb_over_panic+0x48/0x5c (unreliable)
[cf065d20] [c04dc2b0] skb_put+0x5c/0x60
[cf065d30] [c041416c] ingress_rx_default_dqrr+0xf4/0x514
[cf065d80] [c04c2cac] qman_poll_dqrr+0x1f8/0x28c
[cf065db0] [c0415ba0] dpaa_eth_poll+0x24/0x98
[cf065dd0] [c04e7b1c] net_rx_action+0x110/0x338
[cf065e30] [c004e0c8] __do_softirq+0x10c/0x26c
[cf065e90] [c0004b60] do_softirq+0xa0/0xa4
[cf065ea0] [c004d8ac] irq_exit+0x74/0x90
[cf065eb0] [c0004d14] native_do_IRQ+0xd8/0xfc
[cf065ed0] [c000390c] do_IRQ+0x10/0x20
[cf065ee0] [c00101bc] ret_from_except+0x0/0x18
--- Exception: 501 at cpu_idle+0x84/0xe0
    LR = cpu_idle+0x84/0xe0
[cf065fa0] [c000845c] cpu_idle+0xdc/0xe0 (unreliable)
[cf065fc0] [c05d69f0] start_secondary+0x30c/0x324
[cf065ff0] [c0001b04] __secondary_start+0x30/0x84
Instruction dump:
2f800000 80e30098 8103009c 81230090 81430094 419e0024 3c60c06d 90010008 
7ca42b78 386364b4 7d655b78 480f9579 <0fe00000> 48000000 3c80c06a 380424b0 
Kernel panic - not syncing: Fatal exception in interrupt
Call Trace:
[cf065a70] [c0007294] show_stack+0x44/0x160 (unreliable)
[cf065aa0] [c05d3710] panic+0x12c/0x1a0
[cf065af0] [c000d8d4] die+0x13c/0x224
[cf065b20] [c000dbf0] _exception+0xd0/0x1ec
[cf065c20] [c05cd65c] program_check_exception+0xa4/0x644
[cf065c50] [c0010170] ret_from_except_full+0x0/0x4c
--- Exception: 700 at skb_over_panic+0x48/0x5c
    LR = skb_over_panic+0x48/0x5c
[cf065d20] [c04dc2b0] skb_put+0x5c/0x60
[cf065d30] [c041416c] ingress_rx_default_dqrr+0xf4/0x514
[cf065d80] [c04c2cac] qman_poll_dqrr+0x1f8/0x28c
[cf065db0] [c0415ba0] dpaa_eth_poll+0x24/0x98
[cf065dd0] [c04e7b1c] net_rx_action+0x110/0x338
[cf065e30] [c004e0c8] __do_softirq+0x10c/0x26c
[cf065e90] [c0004b60] do_softirq+0xa0/0xa4
[cf065ea0] [c004d8ac] irq_exit+0x74/0x90
[cf065eb0] [c0004d14] native_do_IRQ+0xd8/0xfc
[cf065ed0] [c000390c] do_IRQ+0x10/0x20
[cf065ee0] [c00101bc] ret_from_except+0x0/0x18
--- Exception: 501 at cpu_idle+0x84/0xe0
    LR = cpu_idle+0x84/0xe0
[cf065fa0] [c000845c] cpu_idle+0xdc/0xe0 (unreliable)
[cf065fc0] [c05d69f0] start_secondary+0x30c/0x324
[cf065ff0] [c0001b04] __secondary_start+0x30/0x84
calling kbox_sync :begin
sync dl kbox :begin
flush dl kbox regions :begin
dl kbox region (panic) is writing into (ddrram), action is 200
dl kbox region (panic) has been written into (ddrram)
dev ddrram is dirty
dl kbox region (snapshot) is writing into (ddrram), action is 200
dl kbox region (snapshot) has been written into (ddrram)
dev ddrram is dirty
flush dl kbox regions :end
flush dl kbox superblock :begin
supperblock dev=ddrram is dirty
supperblock dev=ram is clean
flush dl kbox superblock: end
sync dl kbox :end
calling kbox_sync :end 
Rebooting in 180 seconds..

Steps to Reproduce

Sending large packets (1518) to the system, and system will crash.
Live chat
Online