kern/51057: hme(4) device driver bug when tcp4csum and udp4csum are enabled

[cryintothebluesky%googlemail.com@localhost]

>Number:         51057
>Category:       kern
>Synopsis:       hme(4) device driver bug when tcp4csum and udp4csum are enabled
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Apr 09 09:50:00 +0000 2016
>Originator:     Roman
>Release:        7.0_STABLE
>Organization:
>Environment:
NetBSD ultra10 7.0_STABLE NetBSD 7.0_STABLE (GENERIC) #0: Sun Apr  3 17:13:43 BST 2016  roman@atom510:/opt/obj.sparc64/sys/arch/sparc64/compile/GENERIC sparc64
>Description:
All machines are on the same LAN, connected to a single
100Mbps switch. I run scp from NetBSD-7 on amd64 to NetBSD-7 on
sparc64, sooner or later sshd on sparc64 exits with error.

The way I manage to reproduce it:

1. Enable tcp4csum and udp4csum for hme0 on sparc64

2. Simulate heavy I/O on sparc64 by unpacking src.tgz which contains
pkgsrc, src and xsrc

3. Start scp for a 3GB file from amd64 to sparc64

Sooner or later sshd on sparc64 exists with error

Disabling tcp4csum and udp4csu for hme0 and repeating the above steps
always succeeds to scp the entire 3GB file without any errors.

So I'm inclined to think it's either hme0 hardware issue, or NetBSD
kernel bug.


ktrace shows the following:

   161      1 sshd     CALL  read(3,0xffffffffffff7310,0x4000)
   161      1 sshd     GIO   fd 3 read 56 bytes
       "QB\M-u\M-?J\M-V\^C\M-^\M-;i$\M^L\M-kWJ\^S\M-6\M^M\M-C\M-5;\M-u\M^OpV\^Z\M-o7\M-|\M-v8\M^G-dP\r\M^R\M-h7\M-15j\
        \M-)\^V)\M-UI\M-s\^Q\^E\M-S\^C\M^E?\M-02"
   161      1 sshd     RET   read 56/0x38
   161      1 sshd     CALL  __gettimeofday50(0xffffffffffff8710,0)
   161      1 sshd     RET   __gettimeofday50 0
   161      1 sshd     CALL  __sysctl(0xffffffffffff8608,2,0xffffffffffff99e0,0xffffffffffff8600,0,0)
   161      1 sshd     RET   __sysctl 0
   161      1 sshd     CALL  getpid
   161      1 sshd     RET   getpid 161/0xa1, 767/0x2ff
   161      1 sshd     CALL  __socket30(1,0x10000002,0)
   161      1 sshd     RET   __socket30 9
   161      1 sshd     CALL  connect(9,0xfffffffffca65218,0x6a)
   161      1 sshd     MISC  mbsoname: [/var/run/log]
   161      1 sshd     NAMI  "/var/run/log"
   161      1 sshd     RET   connect 0
   161      1 sshd     CALL  sendto(9,0xffffffffffff9048,0x53,0,0,0)
   161      1 sshd     MISC  msghdr: [name=0x0, namelen=0, iov=0x12d967b10, iovlen=1, control=0x0, controllen=0, flags=0]
   161      1 sshd     GIO   fd 9 wrote 83 bytes
       "<38>1 2016-04-07T15:28:58.973455+01:00 ultra10 sshd 161 - - Corrupted MAC on input."
   161      1 sshd     RET   sendto 83/0x53
   161      1 sshd     CALL  close(9)
   161      1 sshd     RET   close 0
   161      1 sshd     CALL  __gettimeofday50(0xffffffffffff89c0,0)
   161      1 sshd     RET   __gettimeofday50 0
   161      1 sshd     CALL  __sysctl(0xffffffffffff88b8,2,0xffffffffffff9c90,0xffffffffffff88b0,0,0)
   161      1 sshd     RET   __sysctl 0
   161      1 sshd     CALL  getpid
   161      1 sshd     RET   getpid 161/0xa1, 767/0x2ff
   161      1 sshd     CALL  __socket30(1,0x10000002,0)
   161      1 sshd     RET   __socket30 9
   161      1 sshd     CALL  connect(9,0xfffffffffca65218,0x6a)
   161      1 sshd     MISC  mbsoname: [/var/run/log]
   161      1 sshd     NAMI  "/var/run/log"
   161      1 sshd     RET   connect 0
   161      1 sshd     CALL  sendto(9,0xffffffffffff92f8,0x80,0,0,0)
   161      1 sshd     MISC  msghdr: [name=0x0, namelen=0, iov=0x12d967b10, iovlen=1, control=0x0, controllen=9, flags=0]
   161      1 sshd     GIO   fd 9 wrote 128 bytes
       "<34>1 2016-04-07T15:28:59.045004+01:00 ultra10 sshd 161 - - fatal: ssh_dispatch_run_fatal: message authenticat\
        ion code incorrect"
   161      1 sshd     RET   sendto 128/0x80
   161      1 sshd     CALL  close(9)
   161      1 sshd     RET   close 0


I assume that "Corrupted MAC on input" may have something to do with network card TCP checksumming

ultra10# cat /etc/ifconfig.hme0 
up
192.168.1.3 netmask 255.255.255.0 tcp4csum udp4csum

Others report similar issues:

https://tty1.net/blog/2014/ssh-corrupted-mac-on-input_en.html


>How-To-Repeat:

>Fix: