<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 92.4pt 1.0in 92.4pt;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoPlainText>Hi Fab,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>After some more testing, we have found that the problem
happens on windows 2008 R2, and we have a simple repro on our machines.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>What you have to do is go to ipoib adapter , and add 2 ip
addresses to the same interface.<o:p></o:p></p>
<p class=MsoPlainText>Here is a dump of the raw data that we get from NDIS 2008
R2:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>4: kd> db 0xfffffa80`0c39f240<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f240 02 00 00 00 02 00 <span
style='background:yellow;mso-highlight:yellow'>10 00-02 00 00 00 10 00 02
00 ................<o:p></o:p></span></p>
<p class=MsoPlainText><span style='background:yellow;mso-highlight:yellow'>fffffa80`0c39f250
0c 7f 00 00 10 04 0c 7f-00 00</span> 00 00 00 00 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f260 00 00 00 00 00 00 00 00-00 00 00
00 00 00 70 9f ..............p.<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f270 04 00 08 02 45 76 65 ee-b4 05 00
00 b8 0b 00 00 ....Eve.........<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f280 00 00 00 00 70 00 00 00-00 00 00
00 00 00 00 00 ....p...........<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f290 00 00 00 00 00 00 00 00-00 00 00
00 00 00 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f2a0 01 00 00 00 00 00 00 00-01 00 00
00 00 00 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c39f2b0 00 00 00 00 00 00 00 00-0c 00 08
00 00 00 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>As you can see, the first struct starts at:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>typedef struct _NETWORK_ADDRESS_LIST {<o:p></o:p></p>
<p class=MsoPlainText> LONG AddressCount; <o:p></o:p></p>
<p class=MsoPlainText> USHORT AddressType; <o:p></o:p></p>
<p class=MsoPlainText> NETWORK_ADDRESS Address[1]; <o:p></o:p></p>
<p class=MsoPlainText>} NETWORK_ADDRESS_LIST, *PNETWORK_ADDRESS_LIST;<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Which means that AddressCount==2 AddressType =2 <o:p></o:p></p>
<p class=MsoPlainText>The first Addresses is marked with yellow. The second addresses
seems like garbage.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Here is a similar Address struct on 2008 <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>fffffa80`0c005ae0 02 00 00 00 02 00 <span
style='background:yellow;mso-highlight:yellow'>10 00-02 00 00 00 00 00 0f
04 ................<o:p></o:p></span></p>
<p class=MsoPlainText><span style='background:yellow;mso-highlight:yellow'>fffffa80`0c005af0
0c 80 00 00 00 00 00 00-00 00</span> <span style='background:lime;mso-highlight:
lime'>10 00 02 00 00 00 ................<o:p></o:p></span></p>
<p class=MsoPlainText><span style='background:lime;mso-highlight:lime'>fffffa80`0c005b00
00 00 10 04 0c 80 00 00-00 00 00 00 00 00</span> 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c005b10 04 00 08 02 4e 74 66 72-00 00 00
00 00 00 00 00 ....Ntfr........<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c005b20 70 11 a4 0c 80 fa ff ff-b0 7b a3
0c 80 fa ff ff p........{......<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c005b30 00 00 00 00 00 00 00 00-00 00 00
00 00 00 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText>fffffa80`0c005b40 00 00 00 00 00 00 00 00-00 00 00
00 00 00 00 00 ................<o:p></o:p></p>
<p class=MsoPlainText>fffffa80<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>The call stack on windows 2008 R2 is:<o:p></o:p></p>
<p class=MsoPlainText>4: kd> k 30<o:p></o:p></p>
<p class=MsoPlainText>Child-SP
RetAddr Call Site<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a6fb0 fffff880`0510b0d6
ipoib!__ipoib_set_net_addr+0xc2 [b:\users\tzachid\mlnx_winof-2_1_2\ulp\ipoib_ndis6_cm\kernel\ipoib_driver.cpp
@ 3461]<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7080 fffff880`0510c0af
ipoib!ipoib_set_info+0xa46
[b:\users\tzachid\mlnx_winof-2_1_2\ulp\ipoib_ndis6_cm\kernel\ipoib_driver.cpp @
2951]<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7160 fffff880`012fc92c
ipoib!ipoib_oid_handler+0xef
[b:\users\tzachid\mlnx_winof-2_1_2\ulp\ipoib_ndis6_cm\kernel\ipoib_driver.cpp @
3105]<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a71a0 fffff880`01278a19
NDIS!ndisMDoOidRequest+0x26c<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7250 fffff880`01278629
NDIS!ndisFQueueRequestOnNext+0x389<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a72c0 fffff880`02d1411b
NDIS!NdisFOidRequest+0xc9<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a73a0 fffff880`012fcd0b
pacer!PcFilterRequest+0x5b<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a73d0 fffff880`012788bd
NDIS!ndisFDoOidRequest+0x21b<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a74a0 fffff880`01278629
NDIS!ndisFQueueRequestOnNext+0x22d<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7510 fffff880`02d0b625
NDIS!NdisFOidRequest+0xc9<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a75f0 fffff880`012fcd0b
wfplwf!FilterOidRequest+0x61<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7620 fffff880`0127822f
NDIS!ndisFDoOidRequest+0x21b<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a76f0 fffff880`0133328e
NDIS!ndisQueueRequestOnTop+0x21f<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7780 fffff880`018590ef
NDIS!ndisMOidRequest+0xde<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7870 fffff880`01817108
tcpip!FlpNdisRequestUnderReference+0x9f<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a79e0 fffff880`0188a54a
tcpip!FlpNdisRequest+0x58<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7a20 fffff880`01811a9a tcpip! ?? ::FNODOBFM::`string'+0x8e50<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7aa0 fffff880`0180ee02
tcpip!IppUpdateFlAddressList+0x5a<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7b10 fffff880`018233c5
tcpip!IppNotifyAddressChangeAtPassive+0x3d2<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7c00 fffff880`0120599b
tcpip!IppInterfaceDelayedWorker+0x15<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7c30 fffff800`0197a541
NETIO!NetiopIoWorkItemRoutine+0x3b<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7c80 fffff800`0168e161
nt!IopProcessWorkItem+0x3d<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7cb0 fffff800`01924166
nt!ExpWorkerThread+0x111<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7d40 fffff800`0165f486
nt!PspSystemThreadStartup+0x5a<o:p></o:p></p>
<p class=MsoPlainText>fffff880`021a7d80 00000000`00000000
nt!KxStartSystemThread+0x16<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Please let us know if you need any more information on
reproducing the issue.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>On a more practical approach (assuming there is no fix in
the short term) I suggest that on windows 2008 R2 we will not try to parse this
structure if it contains more than one element. Please note that this means
that ND will not work on such machines (with more than one ip address per
interface).<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Thanks<o:p></o:p></p>
<p class=MsoPlainText>Tzachi and xAlex<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>> -----Original Message-----<o:p></o:p></p>
<p class=MsoPlainText>> From: ofw-bounces@lists.openfabrics.org [mailto:ofw-<o:p></o:p></p>
<p class=MsoPlainText>> bounces@lists.openfabrics.org] On Behalf Of Fab
Tillier<o:p></o:p></p>
<p class=MsoPlainText>> Sent: Wednesday, August 25, 2010 7:26 PM<o:p></o:p></p>
<p class=MsoPlainText>> To: Alex Naslednikov; Hefty, Sean;
ofw@lists.openfabrics.org<o:p></o:p></p>
<p class=MsoPlainText>> Subject: Re: [ofw] [Patch][ipoib][ipoib_NDIS6_CM]
Fixing a bug when<o:p></o:p></p>
<p class=MsoPlainText>> OID_GEN_NETWORK_LAYER_ADDRESSES contains bad data<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> What are the repro steps for this?<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> Thanks,<o:p></o:p></p>
<p class=MsoPlainText>> -Fab<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> Alex Naslednikov wrote on Tue, 24 Aug 2010 at
23:06:15<o:p></o:p></p>
<p class=MsoPlainText>> <o:p></o:p></p>
<p class=MsoPlainText>> > Yes, we got to the same decision - the
NETWORK_ADDRESS array<o:p></o:p></p>
<p class=MsoPlainText>> contained 5<o:p></o:p></p>
<p class=MsoPlainText>> > 6-bytes chunks instead of 5 14-bytes chunks.
But anyway, this bug at<o:p></o:p></p>
<p class=MsoPlainText>> > NDIS caused BSOD at ipoib (because of memory
violation)<o:p></o:p></p>
<p class=MsoPlainText>> ><o:p></o:p></p>
<p class=MsoPlainText>> > -----Original Message-----<o:p></o:p></p>
<p class=MsoPlainText>> > From: Hefty, Sean [mailto:sean.hefty@intel.com]<o:p></o:p></p>
<p class=MsoPlainText>> > Sent: Monday, August 23, 2010 7:16 PM<o:p></o:p></p>
<p class=MsoPlainText>> > To: Alex Naslednikov; ofw@lists.openfabrics.org<o:p></o:p></p>
<p class=MsoPlainText>> > Subject: RE: [ofw] [Patch][ipoib][ipoib_NDIS6_CM]
Fixing a bug when<o:p></o:p></p>
<p class=MsoPlainText>> > OID_GEN_NETWORK_LAYER_ADDRESSES contains bad
data<o:p></o:p></p>
<p class=MsoPlainText>> ><o:p></o:p></p>
<p class=MsoPlainText>> >> Fixing the bug when NDIS sends
OID_GEN_NETWORK_LAYER_ADDRESSES with<o:p></o:p></p>
<p class=MsoPlainText>> >> the list of new addresses with invalid
formatting (happened when<o:p></o:p></p>
<p class=MsoPlainText>> >> AddressCount<o:p></o:p></p>
<p class=MsoPlainText>> >> =5)<o:p></o:p></p>
<p class=MsoPlainText>> >><o:p></o:p></p>
<p class=MsoPlainText>> >> NDIS sends NETWORK_ADDRESS_LIST structure,
which contains an array<o:p></o:p></p>
<p class=MsoPlainText>> of<o:p></o:p></p>
<p class=MsoPlainText>> >> NETWORK_ADDRESS structures of variable
size.<o:p></o:p></p>
<p class=MsoPlainText>> >> The calculation of the next address offset
is based on<o:p></o:p></p>
<p class=MsoPlainText>> AddressLength;<o:p></o:p></p>
<p class=MsoPlainText>> >> in a case when this field contains wrong
data, one can get access<o:p></o:p></p>
<p class=MsoPlainText>> >> violation error<o:p></o:p></p>
<p class=MsoPlainText>> ><o:p></o:p></p>
<p class=MsoPlainText>> > This sounds like a bug in NDIS<o:p></o:p></p>
<p class=MsoPlainText>> ><o:p></o:p></p>
<p class=MsoPlainText>> > _______________________________________________<o:p></o:p></p>
<p class=MsoPlainText>> > ofw mailing list<o:p></o:p></p>
<p class=MsoPlainText>> > ofw@lists.openfabrics.org<o:p></o:p></p>
<p class=MsoPlainText>> >
http://lists.openfabrics.org/cgi-bin/mailman/listinfo/ofw<o:p></o:p></p>
<p class=MsoPlainText>> _______________________________________________<o:p></o:p></p>
<p class=MsoPlainText>> ofw mailing list<o:p></o:p></p>
<p class=MsoPlainText>> ofw@lists.openfabrics.org<o:p></o:p></p>
<p class=MsoPlainText>> http://lists.openfabrics.org/cgi-bin/mailman/listinfo/ofw<o:p></o:p></p>
</div>
</body>
</html>