Date: Wed, 25 Feb 2015 14:48:53 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 197535] [re] [panic] if_re (Realtek 8168) causes memory write after free and kernel panic Message-ID: <bug-197535-8-gByEqYTn8G@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-197535-8@https.bugs.freebsd.org/bugzilla/> References: <bug-197535-8@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197535 --- Comment #10 from luca.pizzamiglio@gmail.com --- Finally, I get the behavior of the my re0 interface, unfortunately, still without solution. When the driver gets a new descriptor on the rxring, the mbuf is still full of 0xdeadcode. The Memory modified after free: Memory modified after free 0xfffff800039de800(2048) val=ffffffff @ 0xfffff800039de800 The value is the first 4 byte of a broadcast ethernet packet and the address is one previously used to store a mbuf. The first conclusion is that packets are not yet written when a rxring entry is sent. I've also checked why rxring entries are flying away causing page faults: simply, the ring is acting as an array :) In other words, new entries are always written sequentially, violating the size of the ring. When the last element of the ring (idx=255) is used, it correctly rewritten using 0xC0000800 instead of 0x80000800, signalling that it's the last entry of the ring. Any ideas? -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-197535-8-gByEqYTn8G>