netdev2_tap: crashes when hammered

[kaspar030]

(this is a different problem than #3222)

using "ping6 -f %tapX" from two threads on linux to riot at the same time, I can reliably crash native:

(gdb) run tap0
Starting program: /home/kaspar/src/riot.7/examples/ng_networking/bin/native/ng_networking.elf tap0
RIOT native uart0 initialized.
RIOT native interrupts/signals initialized.
LED_GREEN_OFF
LED_RED_ON
RIOT native board initialized.
RIOT native hardware initialization complete.

kernel_init(): This is RIOT! (Version: 2014.12-2147-gb227)
kernel_init(): jumping into first task...
UART0 thread started.
uart0_init() [OK]
RIOT network stack example application
All up, running the shell now
> 
Program received signal SIGSEGV, Segmentation fault.
0x0804f1a4 in _find (prev_ptr=0x8079fe4 <_nomac_stack+7460>, node_ptr=0x8079fe8 <_nomac_stack+7464>, ptr=0x8076bec <_buf+588>)
    at /home/kaspar/src/riot.7/sys/net/crosslayer/ng_pktbuf/_pktbuf_static.c:140
140             node = (_used_t *)node->next;
(gdb)

[miri64]

Did you check this with #3316 merged? Because this fixed a lot of these problems.

[kaspar030]

yes, this is on master.

[PeterKietzmann]

@kaspar030 what are the prerequisites for such a ping from linux to tapX? Just doing it throws "unknown host". I didn’t investigate further.

[kaspar030]

@PeterKietzmann on the linux side, "ip link set tapX up", then "ping6 -f %tapX"

[kaspar030]

@PeterKietzmann I usually create a persistent tap using "openvpn --mktun --dev tap0". That way you can RIOT as non-root, and the tap survives RIOT restarts.

[kaspar030]

Can you also reproduce this?

[PeterKietzmann]

I just gave it a quick try yesterday but I wasn't able to set the tap device up, I guess. Still the "unknown host" thing. I assume I need to spend a bit time the get this running.

[OlegHahm]

I can reproduce.

0x0804f1a4 in _find (prev_ptr=0x8079fe4 <_nomac_stack+7460>, node_ptr=0x8079fe8 <_nomac_stack+7464>, ptr=0x8076a28 <_buf+136>)
    at /home/oleg/git/RIOT/sys/net/crosslayer/ng_pktbuf/_pktbuf_static.c:140
140             node = (_used_t *)node->next;
(gdb) bt
#0  0x0804f1a4 in _find (prev_ptr=0x8079fe4 <_nomac_stack+7460>, node_ptr=0x8079fe8 <_nomac_stack+7464>, ptr=0x8076a28 <_buf+136>)
    at /home/oleg/git/RIOT/sys/net/crosslayer/ng_pktbuf/_pktbuf_static.c:140
#1  0x0804f48a in _pktbuf_internal_free (ptr=0x8076a28 <_buf+136>) at /home/oleg/git/RIOT/sys/net/crosslayer/ng_pktbuf/_pktbuf_static.c:237
#2  0x0804eab5 in ng_pktbuf_release (pkt=0x8076a28 <_buf+136>) at /home/oleg/git/RIOT/sys/net/crosslayer/ng_pktbuf/ng_pktbuf.c:129
#3  0x0804dd76 in _send_data (netdev=0x8075d60 <ng_netdev_eth>, pkt=0x8076a28 <_buf+136>) at /home/oleg/git/RIOT/sys/net/link_layer/ng_netdev_eth/ng_netdev_eth.c:114
#4  0x08057b86 in _nomac_thread (args=0x8075d60 <ng_netdev_eth>) at /home/oleg/git/RIOT/sys/net/link_layer/ng_nomac/ng_nomac.c:92
#5  0xf7dd222b in makecontext () from /usr/lib32/libc.so.6
#6  0x08075d60 in dev_eth_tap ()
#7  0x08073b40 in ?? ()

[kaspar030]

Alright. To rule out nativenet, we need a l2 test application.
Could someone write a shell command that takes <if-pid> <target-mac-addr> <num> [<delay>] [<extra-data>] as arguments,
and sends <num> l2-packets with ethertype 0xffff to <target-mac-addr> via <if-pid> with <delay> us delay between packets.
The payload of the packet should contain the nr of the packet, starting with 0 for the first. If <extra-data> is given, the packet should be filled with that number of garbage bytes (e.g., zeroes).

Volunteers?

[miri64]

@PeterKietzmann I usually create a persistent tap using "openvpn --mktun --dev tap0". That way you can RIOT as non-root, and the tap survives RIOT restarts.

The new and shiny way to go (with iproute2) would be

sudo ip tuntap add dev tap0 mode tap user ${USER}
sudo ip link set tap0 up

This is how it is set up in the tapsetup.sh script (and the unified script introduced in #3182) minus addition to a bridge. This also creates a persistent tap interface accessible by the user USER.

[miri64]

About the shell command: will do: wanted to do something similar on ICMPv6 echo requests anyways. But how does this compare to sending pings from Linux to RIOT? I guess the combination of receiving and sending to two distinct sources is what destroys RIOT here.