[vortex] kfree_skb passed an skb still on a list

Mike Herrick mherrick@openreach.com
Fri Feb 15 11:33:01 2002


This is a multi-part message in MIME format.

------=_NextPart_000_004A_01C1B614.6635FD60
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

I've been running with the 2.2.13 kernel and version V099Ra of the 3c59x.c
driver for quite some time.  Every once and a while, I get "kfree_skb passed
an skb still on a list (from %p)" on the console, and bad things happen.
Sometimes an Oops, sometimes a panic, sometimes just a hang.  It doesn't
happen very often, but it happened twice yesterday, on two different
machines.  Both machines had two ethernet cards, one had two 10b7:9200
3Coms, the other had one 10b7:9200 3Com and an 8086:1229 Intel.  Neither
machine had any load to speak of.

In looking for past occurances of this error I saw that this was used as a
"syndrop or nestea exploit", but it appears this was fixed in the 2.1
release of the kernel.

Any clues?

Thanks,

Mike Herrick

------=_NextPart_000_004A_01C1B614.6635FD60
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2712.300" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>I've been =
running with the=20
2.2.13 kernel and version V099Ra of the 3c59x.c driver for quite some=20
time.&nbsp; Every once and&nbsp;a while, I get "kfree_skb passed an skb =
still on=20
a list (from %p)" on the console, and bad things happen.&nbsp; Sometimes =
an=20
Oops, sometimes a panic, sometimes just a hang.&nbsp; It doesn't happen =
very=20
often, but it happened twice yesterday, on two different machines.&nbsp; =
Both=20
machines had two ethernet cards, one had two 10b7:9200 3Coms, the other =
had one=20
10b7:9200 3Com and an 8086:1229 Intel.&nbsp; Neither machine had any =
load to=20
speak of.</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>In looking for =
past=20
occurances of this error I saw that this was used as a "syndrop or =
nestea=20
exploit", but it appears this was fixed in the 2.1 release of the=20
kernel.</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>Any=20
clues?</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>Mike=20
Herrick</FONT></SPAN></DIV></BODY></HTML>

------=_NextPart_000_004A_01C1B614.6635FD60--