Thread (15 messages) 15 messages, 4 authors, 2009-01-27

Re: [PANIC] lro + iscsi or lro + skb text search causes panic

From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2009-01-22 23:21:39
Subsystem: networking [general], the rest · Maintainers: "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds

On Thu, Jan 22, 2009 at 12:55:21PM -0800, Brandeburg, Jesse wrote:
I've filed this bugzilla a while ago.
http://bugzilla.kernel.org/show_bug.cgi?id=11804
now other customers are becoming interested as well
Does this patch help?

net: Fix frag_list handling in skb_seq_read

The frag_list handling was broken ini skb_seq_read:

1) We didn't add the stepped offset when looking at the head
are of fragments other than the first.

2) The frag index wasn't reset.

This patch fixes both issues.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d7efaf9..ae03c7f 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2215,7 +2215,7 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
 		return 0;
 
 next_skb:
-	block_limit = skb_headlen(st->cur_skb);
+	block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
 
 	if (abs_offset < block_limit) {
 		*data = st->cur_skb->data + abs_offset;
@@ -2260,6 +2260,7 @@ next_skb:
 	} else if (st->root_skb == st->cur_skb &&
 		   skb_shinfo(st->root_skb)->frag_list) {
 		st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+		st->frag_idx = 0;
 		goto next_skb;
 	}
Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help