About the bug that makes pfinet crash

[Thomas Schwinge]

Hello!

Already some time ago I reported about a bug that I could make pfinet
crash doing a casual git-fetch-over-ssh operation.  100% reproducibly.

Today, I tried to systhematically track this down again.  And succeeded.
<http://www.thomas.schwinge.homeip.net/hurd-wiki/hurd/debugging/translator/capturing_stdout_and_stderr.html>

The error: ``pfinet: ../../hurd.work/pfinet/ethernet.c:198:
ethernet_xmit: Unexpected error: (os/device) invalid IO size.''

[hurd]/pfinet/ethernet.c:
    /* Transmit an ethernet frame */
    int
    ethernet_xmit (struct sk_buff *skb, struct device *dev)
    {
      error_t err;
      struct ether_device *edev = (struct ether_device *) dev->priv;
      u_int count;
    
      err = device_write (edev->ether_port, D_NOWAIT, 0, skb->data, skb->len, 
&count);
      assert_perror (err);
      assert (count == skb->len);
      dev_kfree_skb (skb);
      return 0;
    }

As this is on a Xen domU, [gnumach-1-branch-Xen-branch]/xen/net.c:
    static io_return_t
    device_write(void *d, ipc_port_t reply_port,
                      mach_msg_type_name_t reply_port_type, dev_mode_t mode,
                          recnum_t bn, io_buf_ptr_t data, unsigned int count,
                              int *bytes_written)
    {
        [...]
    
        if (count == 0 || count > PAGE_SIZE)
           return D_INVALID_SIZE;

Further printf inspection revealed that skb->len / count was 4110
(reproducibly).  Now I don't know if the Xen net driver is suposed to
handle that, or if pfinet is not supposed to create such large frames.
Where to fix this?


Regards,
 Thomas

signature.asc
Description: Digital signature