r8169: instant crash if receiving packet larger than MTU

r8169: instant crash if receiving packet larger than MTU

[Michael Tokarev]

I played with jumbo frames today at home on two
machines with built-in r8169 NICs.  And discovered
that, after enabling larger packets on one machine,
it's sufficient to send SINGLE packet to immediately,
instantly crash the other machine.

I'd say it's quite a serious issue.  Good it usually
can't be triggered "from outside" (from the Internet)
because there, standard 1500-sized MTU is usually
used (or at least in last-mile network segment), but
on LAN it's quite common nowadays to at least HAVE
the jumbo-capable equipment, and that's all what's
needed to trigger this.

Comments?

(The system in question is based on an Asus M3A78-EM
motherboard, here's the lspci info for the NIC:
02:00.0 0200: 10ec:8168 (rev 02)
	Subsystem: 1043:82c6
	Flags: bus master, fast devsel, latency 0, IRQ 509
	I/O ports at e800 [size=256]
	Memory at fbeff000 (64-bit, non-prefetchable) [size=4K]
	Memory at faff0000 (64-bit, prefetchable) [size=64K]
	Expansion ROM at fbec0000 [disabled] [size=128K]
	Capabilities: [40] Power Management version 3
	Capabilities: [50] Message Signalled Interrupts: Mask- 64bit+ Queue=0/0 Enable+
	Capabilities: [70] Express Endpoint, MSI 01
	Capabilities: [b0] MSI-X: Enable- Mask- TabSize=2
	Capabilities: [d0] Vital Product Data <?>
	Capabilities: [100] Advanced Error Reporting <?>
	Capabilities: [140] Virtual Channel <?>
	Capabilities: [160] Device Serial Number 81-68-10-ec-00-00-00-00
	Kernel driver in use: r8169
	Kernel modules: r8169
)

Thanks!

/mjt

Re: r8169: instant crash if receiving packet larger than MTU

[Francois Romieu]

Michael Tokarev <mjt@tls.msk.ru> :
> I played with jumbo frames today at home on two
> machines with built-in r8169 NICs.  And discovered
> that, after enabling larger packets on one machine,
> it's sufficient to send SINGLE packet to immediately,
> instantly crash the other machine.

Which size did you use and how did it crash (dead keyboard leds
without any message in the console ?) ?

-- 
Ueimor

Re: r8169: instant crash if receiving packet larger than MTU

[Michael Tokarev]

Francois Romieu wrote:
> Michael Tokarev <mjt@tls.msk.ru> :
>> I played with jumbo frames today at home on two
>> machines with built-in r8169 NICs.  And discovered
>> that, after enabling larger packets on one machine,
>> it's sufficient to send SINGLE packet to immediately,
>> instantly crash the other machine.
> 
> Which size did you use and how did it crash (dead keyboard leds
> without any message in the console ?) ?

Original interface MTU was unchanged from the default 1500 bytes.
The packet I sent was of size 8000 bytes.

The crash - one of the machines in question was completely dead,
nothing on the console, and dead keyboard leds.  Another with the
same chip rebooted instantly.

/mjt