[vortex] kfree_skb passed an skb still on a list
Mike Herrick
mherrick@openreach.com
Fri Feb 15 11:33:01 2002
This is a multi-part message in MIME format.
------=_NextPart_000_004A_01C1B614.6635FD60
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
I've been running with the 2.2.13 kernel and version V099Ra of the 3c59x.c
driver for quite some time. Every once and a while, I get "kfree_skb passed
an skb still on a list (from %p)" on the console, and bad things happen.
Sometimes an Oops, sometimes a panic, sometimes just a hang. It doesn't
happen very often, but it happened twice yesterday, on two different
machines. Both machines had two ethernet cards, one had two 10b7:9200
3Coms, the other had one 10b7:9200 3Com and an 8086:1229 Intel. Neither
machine had any load to speak of.
In looking for past occurances of this error I saw that this was used as a
"syndrop or nestea exploit", but it appears this was fixed in the 2.1
release of the kernel.
Any clues?
Thanks,
Mike Herrick
------=_NextPart_000_004A_01C1B614.6635FD60
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2712.300" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>I've been =
running with the=20
2.2.13 kernel and version V099Ra of the 3c59x.c driver for quite some=20
time. Every once and a while, I get "kfree_skb passed an skb =
still on=20
a list (from %p)" on the console, and bad things happen. Sometimes =
an=20
Oops, sometimes a panic, sometimes just a hang. It doesn't happen =
very=20
often, but it happened twice yesterday, on two different machines. =
Both=20
machines had two ethernet cards, one had two 10b7:9200 3Coms, the other =
had one=20
10b7:9200 3Com and an 8086:1229 Intel. Neither machine had any =
load to=20
speak of.</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN> </DIV>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>In looking for =
past=20
occurances of this error I saw that this was used as a "syndrop or =
nestea=20
exploit", but it appears this was fixed in the 2.1 release of the=20
kernel.</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN> </DIV>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>Any=20
clues?</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN> </DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=3D840292316-15022002><FONT =
face=3DArial></FONT></SPAN> </DIV>
<DIV><SPAN class=3D840292316-15022002><FONT face=3DArial>Mike=20
Herrick</FONT></SPAN></DIV></BODY></HTML>
------=_NextPart_000_004A_01C1B614.6635FD60--