On Sun, 1 Sep 2019 16:05:48 -0400
Willem de Bruijn [off-list ref] wrote:
quoted hunk ↗ jump to hunk
One quick fix is to disable sg and thus revert to copying in this
case. Not ideal, but better than a kernel splat:
@@ -3714,6 +3714,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
sg = !!(features & NETIF_F_SG);
csum = !!can_checksum_protocol(features, proto);
+ if (list_skb && skb_headlen(list_skb) && !list_skb->head_frag)
+ sg = false;
+
Many thanks Willem for looking into this.
Indeed the above suggestion avoids the splat, at least with the
reproducer.
I'll look deeper into this, to make sure the generated skbs are indeed
legit and have correct content.
Shmulik