[lkml]   [2009]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
SubjectRe: [Security, resend] Instant crash with rtl8169 and large packets
Michael Tokarev a écrit :
> [Please excuse me for the resend, --
> picked the wrong address for netdev again]
> Hello.
> This is a resend (sort of) of several months old email.
> Previous email about this issue has been mostly ignored.
> The situation is very simple: with an RTL8169 (probably
> onboard) GigE card which, by default, is configured to
> have MTU (maximal transmission unit) to be 1500 bytes,
> it's *trivial* to instantly crash the machine by sending
> it a *single* packet of size >1500 bytes (provided the
> network switch can handle jumbo frames).
> I verified with on several different machines - all I were
> able to find with this card - and all behaves exactly the
> same.
> When sending a packet of size, say, 3000 bytes (ping -s 3000)
> from another machine to a machine running rtl8169 with no
> MTU configured, kernel OOPSes.
> I captured one such OOPS (unfortunately without the first
> line few lines) here:
> (since the network goes boom at that time, no network console
> is working).
> But for anyone familiar with the driver's internals it
> should be easy to figure the issue out.
> This is, in my opinion, quite a serious issue. And I've no
> idea why it is being ignored for several months.

I suppose you use a recent kernel ?

Could you please try following patch ?

Thank you

diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index e94316b..c08b97a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3468,7 +3468,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,

if (status & DescOwn)
- if (unlikely(status & RxRES)) {
+ if (unlikely(status & (RxRES | RxRWT | RxRUNT | RxCRC | RxFOVF))) {
if (netif_msg_rx_err(tp)) {
"%s: Rx ERROR. status = %08x\n",
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2009-06-08 16:31    [W:0.082 / U:10.252 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site