From patchwork Mon Jan 26 22:30:22 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 20346 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 64D13DE0F9 for ; Tue, 27 Jan 2009 09:30:41 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752214AbZAZWag (ORCPT ); Mon, 26 Jan 2009 17:30:36 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751621AbZAZWag (ORCPT ); Mon, 26 Jan 2009 17:30:36 -0500 Received: from rhun.apana.org.au ([64.62.148.172]:51462 "EHLO arnor.apana.org.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751497AbZAZWag (ORCPT ); Mon, 26 Jan 2009 17:30:36 -0500 Received: from gondolin.me.apana.org.au ([192.168.0.6]) by arnor.apana.org.au with esmtp (Exim 4.63 #1 (Debian)) id 1LRZyN-0002Dj-NK; Tue, 27 Jan 2009 09:30:27 +1100 Received: from herbert by gondolin.me.apana.org.au with local (Exim 4.69) (envelope-from ) id 1LRZyJ-0006SY-90; Tue, 27 Jan 2009 09:30:23 +1100 Date: Tue, 27 Jan 2009 09:30:22 +1100 From: Herbert Xu To: David Miller Cc: michaelc@cs.wisc.edu, jesse.brandeburg@intel.com, netdev@vger.kernel.org, olaf.kirch@oracle.com, tgraf@suug.ch, kkeil@suse.de Subject: Re: [PANIC] lro + iscsi or lro + skb text search causes panic Message-ID: <20090126223022.GA24046@gondor.apana.org.au> References: <20090122232131.GA22771@gondor.apana.org.au> <4979097B.4040108@cs.wisc.edu> <20090125.213222.192571170.davem@davemloft.net> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20090125.213222.192571170.davem@davemloft.net> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Sun, Jan 25, 2009 at 09:32:22PM -0800, David Miller wrote: > From: Mike Christie > Date: Thu, 22 Jan 2009 18:04:11 -0600 > > > With the patch running against linus's git tree, my box locks > > up. You cannot ping it. I do not get a oops or anything in the logs, > > and the keyboard does not respond. I will try to get some oops > > output and more info. > > Herbert, any idea offhand? Yeah, I missed an offset update in there :) Here's a better version. net: Fix frag_list handling in skb_seq_read The frag_list handling was broken in skb_seq_read: 1) We didn't add the stepped offset when looking at the head are of fragments other than the first. 2) We didn't take the stepped offset away when setting the data pointer in the head area. 3) The frag index wasn't reset. This patch fixes both issues. Signed-off-by: Herbert Xu Cheers, Signed-off-by: Herbert Xu diff --git a/net/core/skbuff.c b/net/core/skbuff.c index d7efaf9..d4d0e31 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2215,10 +2215,10 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data, return 0; next_skb: - block_limit = skb_headlen(st->cur_skb); + block_limit = skb_headlen(st->cur_skb) + st->stepped_offset; if (abs_offset < block_limit) { - *data = st->cur_skb->data + abs_offset; + *data = st->cur_skb->data + (abs_offset - st->stepped_offset); return block_limit - abs_offset; } @@ -2260,6 +2260,7 @@ next_skb: } else if (st->root_skb == st->cur_skb && skb_shinfo(st->root_skb)->frag_list) { st->cur_skb = skb_shinfo(st->root_skb)->frag_list; + st->frag_idx = 0; goto next_skb; }