Bug 150920 - [ixgbe][igb] Panic when packets are dropped with header split disabled
Summary: [ixgbe][igb] Panic when packets are dropped with header split disabled
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-net (Nobody)
Keywords: IntelNetworking
Depends on:
Reported: 2010-09-24 16:50 UTC by Andrew Boyer
Modified: 2015-07-25 22:33 UTC (History)
1 user (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Boyer 2010-09-24 16:50:01 UTC
The ixgbe and igb drivers have *_rx_discard methods which attempt to
reuse mbufs in the rx_ring.  They fail to check whether the mbuf pointers
are valid before dereferencing them, though.  This causes a panic when
header split is disabled, because the rbuf->m_head pointer will always be NULL.


Check for NULL pointers before dereferencing mh and mp in ixgbe_rx_discard()
and igb_rx_discard().

I don't see any other places where m_head is used without being checked.
How-To-Repeat: Found by adding a failure point in ixgbe_rxeof() right before the staterr
check.  The first packet that's rejected causes a panic.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2010-09-26 22:21:59 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).
Comment 2 Eugene Grosbein 2010-11-02 09:41:39 UTC
This problem seems to be fixed in sys/dev/e1000/if_igb.c,v1.60
but not in STABLE (there were no MFC yet).

By the way, I'm experiencing kernel panics in em(4)
for two distinct very loaded routers based on em-supported NICs
(no crashdumps collected yet, sorry). And I see very similar code
in if_em.c without a check for NULL pointer before dereferencing,
this time without a fix even in HEAD.

Eugene Grosbein
Comment 3 Sean Bruno freebsd_committer 2015-07-25 22:33:21 UTC
igb was fixed here:

r213234 | jfv | 2010-09-27 17:13:15 -0700 (Mon, 27 Sep 2010) | 13 lines

Update code from Intel:
        - Sync shared code with Intel internal
        - New client chipset support added
        - em driver - fixes to 82574, limit queues to 1 but use MSIX
        - em driver - large changes in TX checksum offload and tso
          code, thanks to yongari.
        - some small changes for watchdog issues.
        - igb driver - local timer watchdog code was missing locking
          this and a couple other watchdog related fixes.
        - bug in rx discard found by Andrew Boyer, check for null pointer

MFC: a week

em was fixed here:

r216172 | jfv | 2010-12-03 17:59:58 -0800 (Fri, 03 Dec 2010) | 7 lines

Small cut and paste bug in flow control string fixed.
Second, correct the discard/refresh_mbufs code to behave
more like igb, there have been panics due to discards and
this should fix them.

MFC after: 3 days