Re: [patch] bug prematurely setting nr_frags

On Tue, Aug 13, 2002 at 08:06:13AM +0400, kuznet@ms2.inr.ac.ru wrote:

Hello!

quoted

Huh?  It's called from sock_alloc_send_skb, which is called from all 
over the stack.

It is used with data_len==0. The branch generating fragments is dead.

Ah, I see.  Care for a patch to remove it altogether then?  As for the 
bug, does anyone else see a place where nr_frags can be set without 
initializing a page pointer?  Otherwise it looks like a random memory 
corruption... what fun.

		-ben
-- 
"You will be reincarnated as a toad; and you will be much happier."

Hello!

Ah, I see.  Care for a patch to remove it altogether then?

Well, someone wrote it for some purpose. :-) 

						  As for the 
bug, does anyone else see a place where nr_frags can be set without 
initializing a page pointer? 

No. When does this happen?

Otherwise it looks like a random memory corruption... what fun.

Well, even if this is corruption, it is unlikely to be random.
This maybe write beyond end of an skb, corrupting skb_shared_info.
At least, we had such place in netfilter fixed some time ago.

Alexey