vmnet module causes kernel crash when Android phone is connected

[sheinz]

Hi,

I'm running VMware® Workstation 12 Pro (12.5.5 build-5234757) on Arch Linux with kernel 4.10.10-1-userns

Each time I connect my Android phone as a USB tethering (usb network device) module vmnet causes kernel crash.

[    2.249681] rndis_host 3-10:1.0 usb0: register 'rndis_host' at usb-0000:00:14.0-10, RNDIS device, 2a:e8:6f:ae:e3:d0

[    2.249715] /dev/vmnet: open called by PID 469 (vmnet-bridge)

[    2.249718] /dev/vmnet: hub 0 does not exist, allocating memory.

[    2.249725] /dev/vmnet: port on hub 0 successfully opened

[    2.249730] bridge-enp4s0: up

[    2.249731] bridge-enp4s0: attached

[    2.250288] usbcore: registered new interface driver rndis_host

[    2.251182] rndis_host 3-10:1.0 enp0s20u10: renamed from usb0

[    2.267828] IPv6: ADDRCONF(NETDEV_UP): enp0s20u10: link is not ready

[    2.310115] bridge-enp4s0: disabling the bridge

[    2.329430] bridge-enp4s0: down

[    2.329433] bridge-enp4s0: detached

[    2.329481] /dev/vmnet: open called by PID 469 (vmnet-bridge)

[    2.329484] /dev/vmnet: hub 0 does not exist, allocating memory.

[    2.329507] /dev/vmnet: port on hub 0 successfully opened

[    2.329511] bridge-enp0s20u10: can't bridge with enp0s20u10, bad header length 58

[    2.329532] BUG: stack guard page was hit at ffffc900021d41c0 (stack is ffffc900021d0000..ffffc900021d3fff)

[    2.329535] kernel stack overflow (page fault): 0000 [#1] PREEMPT SMP

[    2.329554] Modules linked in: hid_generic(+) snd_hda_codec_hdmi rndis_host cdc_ether usbhid usbnet vmnet(O) fuse vmw_vsock_vmci_transport vsock vmw_vmci vmmon(O) snd_hda_codec_realtek snd_hda_codec_generic iTCO_wdt iTCO_vendor_support eeepc_wmi asus_wmi sparse_keymap evdev rfkill ppdev mxm_wmi mac_hid intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd intel_cstate intel_rapl_perf pcspkr 8139too 8139cp i2c_i801 lpc_ich mii snd_hda_intel i915 fan thermal snd_hda_codec snd_soc_rt5640 snd_hda_core battery drm_kms_helper snd_soc_rl6231 snd_soc_ssm4567 snd_soc_core parport_pc drm parport snd_compress tpm_infineon snd_hwdep wmi video e1000e fjes intel_gtt

[    2.329736]  snd_pcm_dmaengine syscopyarea snd_pcm ac97_bus sysfillrect snd_timer elan_i2c snd sysimgblt fb_sys_fops i2c_hid i2c_algo_bit soundcore hid snd_soc_sst_acpi snd_soc_sst_match i2c_designware_platform mei_me 8250_dw i2c_designware_core ptp acpi_pad mei spi_pxa2xx_platform pps_core button shpchp tpm_tis tpm_tis_core tpm sch_fq_codel vboxnetflt(O) vboxnetadp(O) pci_stub vboxpci(O) vboxdrv(O) ftdi_sio usbserial ip_tables x_tables ext4 crc16 jbd2 fscrypto mbcache sd_mod ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd scsi_mod usbcore usb_common serio sdhci_acpi sdhci led_class mmc_core

[    2.329857] CPU: 3 PID: 469 Comm: vmnet-bridge Tainted: G           O    4.10.10-1-userns #1

[    2.329874] Hardware name: ASUS All Series/H97M-PLUS, BIOS 0320 05/09/2014

[    2.329888] task: ffff88040a9bb900 task.stack: ffffc900021d0000

[    2.329904] RIP: 0010:VNetBridgeNotify+0x3f/0x150 [vmnet]

[    2.329916] RSP: 0018:ffffc900021d3c90 EFLAGS: 00010246

[    2.329927] RAX: 0000000000000000 RBX: ffff88040b932800 RCX: 0000000000000006

[    2.329942] RDX: ffffc900021d3cc0 RSI: 0000000000000001 RDI: ffff88040b932800

[    2.329968] RBP: ffffc900021d3ca8 R08: 0000000000000001 R09: 0000000000000316

[    2.329982] R10: 0000000000000000 R11: 0000000000000316 R12: 0000000000000000

[    2.329996] R13: ffffffff81ac4c58 R14: ffff88040d37a000 R15: ffffffff81ac4b40

[    2.330010] FS:  00007f1b3dcec700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000

[    2.330026] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[    2.330037] CR2: ffffc900021d41c0 CR3: 00000004036fa000 CR4: 00000000001406e0

[    2.330051] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

[    2.330066] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

[    2.330079] Call Trace:

[    2.330088]  register_netdevice_notifier+0x1d5/0x1e0

[    2.330100]  VNetBridge_Create+0x206/0x230 [vmnet]

[    2.330111]  VNetFileOpUnlockedIoctl+0x637/0x800 [vmnet]

[    2.330123]  ? do_filp_open+0xa5/0x100

[    2.330133]  do_vfs_ioctl+0xa3/0x5f0

[    2.330141]  ? putname+0x54/0x60

[    2.330149]  SyS_ioctl+0x79/0x90

[    2.330158]  entry_SYSCALL_64_fastpath+0x1a/0xa9

[    2.330169] RIP: 0033:0x7f1b3d6150d7

[    2.330177] RSP: 002b:00007ffd39a1f678 EFLAGS: 00000246 ORIG_RAX: 0000000000000010

[    2.330192] RAX: ffffffffffffffda RBX: 00005577ab53a240 RCX: 00007f1b3d6150d7

[    2.330206] RDX: 00007ffd39a1f690 RSI: 00000000402499e4 RDI: 0000000000000008

[    2.330220] RBP: 00005577ace99100 R08: 00005577ace99130 R09: 0000000000000000

[    2.330234] R10: 0000000000000000 R11: 0000000000000246 R12: 00005577ab53a278

[    2.330248] R13: 00005577ab318fe0 R14: 00005577ab53a180 R15: 0000000000000001

[    2.330262] Code: 83 fe 02 0f 84 bf 00 00 00 48 83 fe 06 0f 84 8c 00 00 00 48 83 fe 01 74 0b 48 83 c4 08 31 c0 5b 41 5c 5d c3 48 83 7f 28 00 75 ee <48> 81 ba 00 05 00 00 40 4b ac 81 75 e1 4c 8d 67 18 48 89 d7 48

[    2.330311] RIP: VNetBridgeNotify+0x3f/0x150 [vmnet] RSP: ffffc900021d3c90

[    2.335040] ---[ end trace 6d95810e041252de ]---

[    2.556682] /dev/vmnet: open called by PID 584 (vmnet-netifup)

[    2.556694] /dev/vmnet: hub 1 does not exist, allocating memory.

[    2.556719] /dev/vmnet: port on hub 1 successfully opened

[    2.636308] clocksource: Switched to clocksource tsc

[    5.374718] e1000e: eno1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None

[ddellios]

Hello,

Same here with a USB network adapter. As a workaround, go to Edit > Virtual Network Editor, select vmnet0 (or whatever interface you have as bridged) and in "bridged to" change it from automatic to one of your local adapters, eg. wlan0. Then plug your phone or whatever USB network adapter you have.

[arkh4mkn1ght]

Hello

I'm experiencing the same problem, USB tether with VMware Worksation 12.5.5 and also with the latest 12.5.6. Host is a Linux machine with kernel 4.10.8:

[  199.933274] BUG: stack guard page was hit at ffffc21d02854208 (stack is ffffc21d02850000..ffffc21d02853fff)

[  199.933278] kernel stack overflow (page fault): 0000 [#1] SMP

[  199.936421] Modules linked in: rndis_host cdc_ether usbnet mii vmnet(O) parport_pc vmw_vsock_vmci_transport vsock vmw_vmci vmmon(O) binfmt_misc nf_conntrack_tftp nf_conntrack_sip nf_conntrack_sane nf_conntrack_pptp nf_conntrack_proto_gre nf_conntrack_netlink nfnetlink nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp ts_kmp nf_conntrack_amanda nf_conntrack ip6_tables x_tables rfcomm ctr ccm cmac ppdev parport af_packet bnep joydev hid_multitouch btusb btrtl iTCO_wdt iTCO_vendor_support i2c_designware_platform i2c_designware_core tpm_crb msr arc4 intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel uvcvideo pcbc videobuf2_vmalloc videobuf2_memops videobuf2_v4l2

[  199.936441]  videobuf2_core aesni_intel snd_hda_codec_hdmi aes_x86_64 videodev crypto_simd glue_helper cryptd media snd_hda_codec_realtek snd_hda_codec_generic psmouse iwlmvm input_leds serio_raw snd_hda_intel mac80211 snd_hda_codec snd_hda_core snd_hwdep intel_th_gth snd_pcm intel_th_pci snd_timer intel_th fuse snd i2c_i801 soundcore nls_utf8 nls_cp437 iwlwifi vfat fat cfg80211 rtsx_pci_ms memstick mei_me shpchp mei idma64 virt_dma intel_pch_thermal intel_lpss_pci hci_uart thermal wmi i2c_hid hid btbcm btqca btintel bluetooth battery rfkill pinctrl_sunrisepoint pinctrl_intel intel_lpss_acpi intel_lpss fjes tpm_tis tpm_tis_core acpi_pad ac tpm cpufreq_ondemand cpufreq_conservative cpufreq_powersave nvram evdev sch_fq_codel ipv6 crc_ccitt autofs4 efivarfs rtsx_pci_sdmmc mmc_core nvme xhci_pci nvme_core

[  199.936466]  xhci_hcd rtsx_pci usbcore usb_common i915 video button i2c_algo_bit drm_kms_helper drm [last unloaded: vmnet]

[  199.936472] CPU: 2 PID: 4464 Comm: vmnet-bridge Tainted: G     U     O    4.10.8 #1

[  199.936472] Hardware name: VAIO Corporation VJZ13B/VAIO, BIOS R1193SA 09/22/2016

[  199.936473] task: ffff9d551b630000 task.stack: ffffc21d02850000

[  199.936478] RIP: 0010:VNetBridgeNotify+0x3f/0x150 [vmnet]

[  199.936479] RSP: 0018:ffffc21d02853cd8 EFLAGS: 00010246

[  199.936479] RAX: 0000000000000000 RBX: ffff9d55205a8000 RCX: 0000000000000006

[  199.936480] RDX: ffffc21d02853d08 RSI: 0000000000000001 RDI: ffff9d55205a8000

[  199.936480] RBP: ffffc21d02853cf0 R08: 0000000000000001 R09: 00000000000003a2

[  199.936481] R10: fffff9e2906e8a00 R11: 00000000000003a2 R12: ffff9d552be25000

[  199.936481] R13: 0000000000000000 R14: ffffffff88cfd198 R15: ffffffff88cfd080

[  199.936482] FS:  00007f5c9a838700(0000) GS:ffff9d553ed00000(0000) knlGS:0000000000000000

[  199.936482] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[  199.936483] CR2: ffffc21d02854208 CR3: 000000041ba88000 CR4: 00000000003406e0

[  199.936483] Call Trace:

[  199.936487]  register_netdevice_notifier+0x184/0x1b0

[  199.936489]  VNetBridge_Create+0x243/0x270 [vmnet]

[  199.936491]  VNetFileOpUnlockedIoctl+0x6cb/0x810 [vmnet]

[  199.936492]  ? filemap_map_pages+0x34f/0x360

[  199.936495]  do_vfs_ioctl+0x90/0x5a0

[  199.936497]  ? tomoyo_file_ioctl+0x19/0x20

[  199.936498]  SyS_ioctl+0x79/0x90

[  199.936499]  entry_SYSCALL_64_fastpath+0x1e/0xad

[  199.936500] RIP: 0033:0x7f5c9a15a557

[  199.936501] RSP: 002b:00007ffd49566588 EFLAGS: 00000246 ORIG_RAX: 0000000000000010

[  199.936501] RAX: ffffffffffffffda RBX: 00005575d4165264 RCX: 00007f5c9a15a557

[  199.936502] RDX: 00007ffd495665a0 RSI: 00000000402499e4 RDI: 0000000000000008

[  199.936502] RBP: 00005575d41650a0 R08: 00000000ffffffff R09: 00005575d51a4120

[  199.936503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003

[  199.936503] R13: 00005575d51a40f0 R14: 00005575d4165180 R15: 00005575d4165264

[  199.936504] Code: 83 fe 02 0f 84 c3 00 00 00 48 83 fe 06 0f 84 8e 00 00 00 48 83 fe 01 74 0b 48 83 c4 08 31 c0 5b 41 5c 5d c3 48 83 7f 28 00 75 ee <48> 81 ba 00 05 00 00 80 d0 cf 88 75 e1 4c 8d 67 18 48 89 d7 48

[  199.936517] RIP: VNetBridgeNotify+0x3f/0x150 [vmnet] RSP: ffffc21d02853cd8

[  199.952320] ---[ end trace a9e08500a27ca42b ]---

Any plans to fix this issue??? it has been months unresolved...

[dariusd]

Hi everyone,

Thanks for reporting this issue, and sorry it went unnoticed for so long.  Your fellow Arch Linux user swordfeng​ figured out the problem over in thread Re: Issue in Workstation 12.5.5 Linux vmnet module​, and we've got the fix queued up for future releases.

To use the fix from that thread, you'll need to unpack /usr/lib/vmware/modules/source/vmnet.tar and patch (or manually edit) vmnet-only/bridge.c according to that thread, and re-pack vmnet.tar.  That should get you by until the next update is released.

Cheers,

--

Darius

[arkh4mkn1ght]

Thanks, i have solved the issue now and USB tethering works fine with VMware Workstation 12.5.6 and Linux Kernel 4.10.8 by applying that patch plus a another one i had to make for the tethering to work.

I applied the patch shown in the link :

Issue in Workstation 12.5.5 Linux vmnet module

--- bridge.c 2017-05-14 02:24:23.764324763 +0800

+++ bridge_new.c 2017-05-14 02:24:20.494352085 +0800

@@ -1146,7 +1146,7 @@

void *data) // IN: device pertaining to event

{

VNetBridge *bridge = list_entry(this, VNetBridge, notifier);

- struct net_device *dev = (struct net_device *) data;

+ struct net_device *dev = netdev_notifier_info_to_dev(data);

switch (msg) {

case NETDEV_UNREGISTER:

That patch fixed the kernel panic but still the USB tethering was not working.

For some reason that check was making the Kernel abort enabling the bridge:

[ 2796.200693] bridge-enp0s20f0u2: can't bridge with enp0s20f0u2, bad header length 58

[ 2796.200697] bridge-enp0s20f0u2: enabling the bridge on dev up

[ 2796.200698] bridge-enp0s20f0u2: can't bridge with enp0s20f0u2, bad header length 58

[ 2796.200698] bridge-enp0s20f0u2: interface enp0s20f0u2 is not a valid Ethernet interface

[ 2796.200699] bridge-enp0s20f0u2: attached

So investigating i had to comment the following lines also in bridge.c:

938    / * if (bridge->dev->hard_header_len != ETH_HLEN) {

939       LOG(1, (KERN_DEBUG "bridge-%s: can't bridge with %s, bad header length %d\n",

940               bridge->name, bridge->dev->name, bridge->dev->hard_header_len));

941       dev_unlock_list();

942       retval = -EINVAL;

943       goto out;

944    } */

After commenting those lines and recompiling the vmnet module i was able to switch between WIFI and USB tethering in my virtual machines without kernel panics or

kernel bridge errors. I hope this info helps more people

Thanks !