PROBLEM: arcnet bugs in 2.4.x

PROBLEM: arcnet bugs in 2.4.x

[Petr Bavorovsky]

	Hello,
there are two problems with arcnet drivers.

* Summary
1) arping utility cause kernel oops when used for arcnet NIC
2) "BUG: no buffers are available??" message

*System information
Linux version 2.4.16 (root@hostel.nstu.ru) (gcc version 2.96 20000731 (Red Hat
Linux 7.1 2.96-98)) #2 Сбт Дек 8 13:30:06 NOVT 2001
Bugs also persist on all earlier 2.4.x kernel I tested

# cat /proc/cpuinfo
processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 6
model           : 4
model name      : AMD Athlon(tm) Processor
stepping        : 2
cpu MHz         : 697.652
cache size      : 256 KB
fdiv_bug        : no
hlt_bug         : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 sep mtrr pge mca cmov pat
pse36 mmx fxsr syscall mmxext 3dnowext 3dnow
bogomips        : 1392.64

# cat /proc/modules
3c59x                  24544   1
de4x5                  39952   2
com90xx                 5824   1
rfc1201                 5280   0 (unused)
arcnet                  9184   0 [com90xx rfc1201]
ipt_REDIRECT             704   1 (autoclean)
ipt_REJECT              2784   1 (autoclean)
iptable_filter          1648   0 (autoclean) (unused)
iptable_nat            13040   0 [ipt_REDIRECT]
ip_conntrack           13072   1 [ipt_REDIRECT iptable_nat]
ip_queue                5552   0 (unused)
ip_tables              10624   6 [ipt_REDIRECT ipt_REJECT iptable_filter 
iptable_nat]
rtc                     5632   0 (autoclean)

*Details
There is an arcnet interface in system
# ifconfig arc0
arc0      Link encap:ARCnet  HWaddr 03
          inet addr:193.125.1.254  Bcast:193.125.1.255  Mask:255.255.255.252
          UP BROADCAST RUNNING  MTU:1500  Metric:1
          RX packets:6548827 errors:7 dropped:3 overruns:0 frame:4
          TX packets:3498925 errors:16276 dropped:0 overruns:0 carrier:23344
          collisions:0 txqueuelen:30
          RX bytes:1953724850 (1863.2 Mb)  TX bytes:305177825 (291.0 Mb)
          Interrupt:3 Base address:0x300 Memory:d0000-d07ff

First problem:
# arping -D -I arc0 193.125.1.253
ARPING 193.125.1.88 from 0.0.0.0 arc0
Segmentation fault

arc0: arcnet_header: Yikes!  skb->len(0) != len(18)!
Unable to handle kernel NULL pointer dereference at virtual address 00000064
 printing eip:
d084285b
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[<d084285b>]    Not tainted
EFLAGS: 00010282
eax: 000000ff   ebx: c2a3b9c0   ecx: 000000ff   edx: d084336c
esi: cf6ef000   edi: 00000000   ebp: 00000806   esp: c7c43de0
ds: 0018   es: 0018   ss: 0018
Process arping (pid: 18604, stackpage=c7c43000)
Stack: ffa3b9c0 c2a3b9c0 cf6ef000 cfd7f000 00000806 d083a63d c2a3b9c0 00000806
       000000ff c2a3b9c0 cfd7f000 c7c43ed0 00000012 c01d7227 c2a3b9c0 cfd7f000
       00000806 c7c43efc 00000000 00000012 c7c43efc 06080000 cf607500 ffffffea
Call Trace: [<d083a63d>] [<c01d7227>] [<c0122deb>] [<c019899b>] [<c0198500>]
   [<c01996ed>] [<c010fd9e>] [<c0166435>] [<c011bc02>] [<c0199e97>] 
[<c0106ceb>]

Code: 8b 77 64 83 ab 80 00 00 00 08 83 43 5c 08 8b 8b 80 00 00 00

Second problem:
There are lot of "kernel:   arc0: get_arcbuf: BUG: no buffers are 
available??" messages in logs.

Please ask if you are interested in more details which I might forget to 
write. If you have any comments/patches please send it as well.

	Petr Bavorovsky,
	Novosibirsk, Russian Federation.

Re: PROBLEM: arcnet bugs in 2.4.x

[Alan Cox]

> arc0: arcnet_header: Yikes!  skb->len(0) !=3D len(18)!
> Unable to handle kernel NULL pointer dereference at virtual address 000=
> 00064
>  printing eip:

It looks like the drivers are making a few assumptions about headers and
length they shouldn't be. I don't think anyone is maintaining ARCnet any
more, all those who worked on it before have moved on to more real
networking. Its one of those things that may well just vanish in 2.5 if
nobody becomes a maintainer.

Looking at the code it looks like arcnet_header is a bit fragile when handed
non random "normal" network layer frames.

The length check is redundant (and wrong) - which explains the message, but
the oops isn't obvious from inspection. Probably you want to turn on debug
and see where in the build/rebuild of the header it dies

Alan

Re: PROBLEM: arcnet bugs in 2.4.x

[Martin Mares]

Hello, world!\n

> It looks like the drivers are making a few assumptions about headers and
> length they shouldn't be. I don't think anyone is maintaining ARCnet any
> more, all those who worked on it before have moved on to more real
> networking. Its one of those things that may well just vanish in 2.5 if
> nobody becomes a maintainer.

I still use ARCnet in my home network and I'll hopefully find some
free time over the Christmas to fix these bugs.

				Have a nice fortnight
-- 
Martin `MJ' Mares   <mj@ucw.cz>   http://atrey.karlin.mff.cuni.cz/~mj/
Faculty of Math and Physics, Charles University, Prague, Czech Rep., Earth
Outside of a dog, a book is man's best friend. Inside a dog, it's too dark to read.