netdev
[Top] [All Lists]

Re: BUG: 2.3.35 SMP tcpdump crash

To: kuznet@xxxxxxxxxxxxx
Subject: Re: BUG: 2.3.35 SMP tcpdump crash
From: Rusty Russell <rusty@xxxxxxxxxxxxxxxx>
Date: Wed, 05 Jan 2000 14:19:27 +1100
Cc: davem@xxxxxxxxxx (David S. Miller), netdev@xxxxxxxxxxx
In-reply-to: Your message of "Mon, 03 Jan 2000 18:51:45 +0300." <200001031551.SAA22407@xxxxxxxxxxxxx>
Sender: owner-netdev@xxxxxxxxxxx
In message <200001031551.SAA22407@xxxxxxxxxxxxx> you write:
> skb_copy() copied _all_ because it was called from obscure contexts,
> when we wanted to make full exact mirror of skb. Mostly it was useless
> work, certainly. But net/* still gets MAC header stripped, and we
> want to preserve it sometimes.

I must be very stupid today.  skb_copy() still copies MAC header:

        /* Copy the bytes */
        memcpy(n->head,skb->head,skb->end-skb->head);

Did you mean skb_cow()?

> Well, all this is blather, for now the only practical question
> is to audit code and check that skb_copy() is not used before all
> the information from MAC header is extracted.

If you mean skb_cow: why not revert my recent `fix'.  Something like
this, and be happy 8-).

--- linux-2.3-official/net/core/skbuff.c        Wed Jan  5 14:13:36 2000
+++ linux-2.3-official/net/core/skbuff.c.~2~    Wed Jan  5 14:10:55 2000
@@ -345,6 +345,9 @@
 {
        struct sk_buff *n;
 
+       if (newheadroom < skb_headroom(skb))
+               newheadroom = skb_headroom(skb);
+
        /*
         *      Allocate the copy buffer
         */
@@ -358,9 +361,8 @@
 
        /* Set the tail pointer and length */
        skb_put(n,skb->len);
-
-       /* Copy the data only. */
-       memcpy(n->data, skb->data, skb->len);
+       /* Copy the bytes: data pointers must point to same data. */
+       memcpy(n->data - skb_headroom(skb), skb->head, skb->end-skb->head);
 
        copy_skb_header(n, skb);
        return n;
--
Hacking time.

<Prev in Thread] Current Thread [Next in Thread>