Re: Mail delivery failed: returning message to sender

["David S. Miller" <davem@xxxxxxxxxx>]

   From: Russell King <rmk@xxxxxxxxxxxxxxxx>
   Date: Wed, 21 May 2003 01:21:48 +0100

   fragheaderlen 20 maxfraglen 1802201956 mtu 1802201963
   fragheaderlen 20 maxfraglen 1802201956 mtu 1802201963
   
   The 1802201956 number is rather interesting.  It's 0x6b6b6b6b, which
   seems to be the slab poison-after.

Russel, thanks for the report.

Alexey, when IP redirect happens during UDP sendfile, all things
go to shit. These messages above were generated by a printk
in ip_append_data() right after maxfraglen is computed.

I STRONGLY suspect the *rt = *rth assignment in
route.c:ip_rt_redirect().  In particular this results in
rt->u.dst.path pointing to the old &rth->u.dst, oops.

Russel, please retest using this patch.  This piece of
code needs to be audited further.

--- net/ipv4/route.c.~1~        Tue May 20 17:53:55 2003
+++ net/ipv4/route.c    Tue May 20 17:54:12 2003
@@ -964,6 +964,7 @@
                                rt->u.dst.neighbour     = NULL;
                                rt->u.dst.hh            = NULL;
                                rt->u.dst.obsolete      = 0;
+                               rt->u.dst.path          = &rt->u.dst;
 
                                rt->rt_flags            |= RTCF_REDIRECTED;