[Bug 294726] Netmap vale dropping packets to iflib driver crashes kernel

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294726

            Bug ID: 294726
           Summary: Netmap vale dropping packets to iflib driver crashes
                    kernel
           Product: Base System
           Version: 14.3-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: nreilly@qnx.com

If nm_vale_flush() in sys/dev/netmap/netmap_vale.c needs to drop a packet, it
sets the length = 0. In the case of an iflib driver this ends up in
iflib_netmap_txsync() in sys/net/iflib.c where the while() starts off with
seg_idx = 0 and only increments it if the segment has length - which in this
case it doesn't. seg_idx is passed to the driver isc_txd_encap() as
pi.ipi_nsegs.

Most iflib drivers have an encap function (e.g. igb_isc_txd_encap() in
sys/dev/e1000/igb_txrx.c, or vmxnet3_isc_txd_encap() in
sys/dev/vmware/vmxnet3/if_vmx.c) that loops based on the number of segments,
setting the tx descriptor for each segment and then after the loop completes
they set the last tx descriptor end-of-packet flag, . In this case the loop has
not been entered as nsegs = 0 so the setting of the end-of-packet happens on an
unitialized Tx descriptor pointer, likely crashing the kernel.

Here's one way to reproduce this using the netmap pkt-gen utility from
/usr/src/tools/tools/netmap on a vmx interface.

1) Disable offloads
ifconfig vmx0 -rxcsum -txcsum -tso4 -rxcsum6 -txcsum6 -tso6

2) Increase the netmap buffer size to > 2048
sysctl dev.netmap.priv_buf_size=10000

3) Add the interface to a vale switch
valectl -h vale0:vmx0

4) Send packets with a size > 2048 and < 10000
pkt-gen -i vale0:vm1 -f tx -R 5 -l 5000 -d 192.168.122.254 -D 52:54:00:ad:86:18
-S 02:01:02:03:04:05

nm_vale_flush() will drop the packet by setting its length to 0 as it comes in
with a size of 5000 but the vmx interface only has buffers of size 2000.

-- 
You are receiving this mail because:
You are the assignee for the bug.