[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
About the bug that makes pfinet crash
From: |
Thomas Schwinge |
Subject: |
About the bug that makes pfinet crash |
Date: |
Fri, 21 Nov 2008 00:08:32 +0100 |
User-agent: |
Mutt/1.5.11 |
Hello!
Already some time ago I reported about a bug that I could make pfinet
crash doing a casual git-fetch-over-ssh operation. 100% reproducibly.
Today, I tried to systhematically track this down again. And succeeded.
<http://www.thomas.schwinge.homeip.net/hurd-wiki/hurd/debugging/translator/capturing_stdout_and_stderr.html>
The error: ``pfinet: ../../hurd.work/pfinet/ethernet.c:198:
ethernet_xmit: Unexpected error: (os/device) invalid IO size.''
[hurd]/pfinet/ethernet.c:
/* Transmit an ethernet frame */
int
ethernet_xmit (struct sk_buff *skb, struct device *dev)
{
error_t err;
struct ether_device *edev = (struct ether_device *) dev->priv;
u_int count;
err = device_write (edev->ether_port, D_NOWAIT, 0, skb->data, skb->len,
&count);
assert_perror (err);
assert (count == skb->len);
dev_kfree_skb (skb);
return 0;
}
As this is on a Xen domU, [gnumach-1-branch-Xen-branch]/xen/net.c:
static io_return_t
device_write(void *d, ipc_port_t reply_port,
mach_msg_type_name_t reply_port_type, dev_mode_t mode,
recnum_t bn, io_buf_ptr_t data, unsigned int count,
int *bytes_written)
{
[...]
if (count == 0 || count > PAGE_SIZE)
return D_INVALID_SIZE;
Further printf inspection revealed that skb->len / count was 4110
(reproducibly). Now I don't know if the Xen net driver is suposed to
handle that, or if pfinet is not supposed to create such large frames.
Where to fix this?
Regards,
Thomas
signature.asc
Description: Digital signature
- About the bug that makes pfinet crash,
Thomas Schwinge <=