lkml.org 
[lkml]   [2004]   [Feb]   [25]   [last100]   RSS Feed
Views: [more markup]   [less markup]   [headers]   [forward]  
 
Messages in this thread
Patch in this message
/
DateTue, 24 Feb 2004 23:22:05 -0800
FromAndrew Morton <>
SubjectRe: [BUG] 2.6.3 Slab corruption: errors are triggered when memory exceeds 2.5GB (correction)
"David S. Miller" <davem@redhat.com> wrote:
>
> On Wed, 25 Feb 2004 07:21:56 +0100
> Manfred Spraul <manfred@colorfullife.com> wrote:
> 
> > 0x620 (1568) is behind the end of the actual eth frame. Who could modify 
> > that?
> 
> At the end of the SKB data area is where we keep struct skb_shared_info, something
> is messing with the SKB state after a free it appears.
> 
> And since it's turning the debugging value 0x6b to 0x6a it must be the
> "atomic_t dataref;" that is being mucked with.

Ah-hah.

This should find it:


 25-akpm/include/linux/skbuff.h |    1 +
 25-akpm/net/core/dev.c         |    1 +
 25-akpm/net/core/skbuff.c      |    6 ++++++
 3 files changed, 8 insertions(+)
diff -puN include/linux/skbuff.h~dataref-debug include/linux/skbuff.h
--- 25/include/linux/skbuff.h~dataref-debug	Tue Feb 24 23:18:56 2004
+++ 25-akpm/include/linux/skbuff.h	Tue Feb 24 23:19:20 2004
@@ -140,6 +140,7 @@ struct skb_frag_struct {
  */
 struct skb_shared_info {
 	atomic_t	dataref;
+	int		debug;
 	unsigned int	nr_frags;
 	unsigned short	tso_size;
 	unsigned short	tso_segs;
diff -puN net/core/dev.c~dataref-debug net/core/dev.c
--- 25/net/core/dev.c~dataref-debug	Tue Feb 24 23:18:56 2004
+++ 25-akpm/net/core/dev.c	Tue Feb 24 23:19:34 2004
@@ -1272,6 +1272,7 @@ int __skb_linearize(struct sk_buff *skb,
 	/* Set up shinfo */
 	ninfo = (struct skb_shared_info*)(data + size);
 	atomic_set(&ninfo->dataref, 1);
+	ninfo->debug = 0;
 	ninfo->tso_size = skb_shinfo(skb)->tso_size;
 	ninfo->tso_segs = skb_shinfo(skb)->tso_segs;
 	ninfo->nr_frags = 0;
diff -puN net/core/skbuff.c~dataref-debug net/core/skbuff.c
--- 25/net/core/skbuff.c~dataref-debug	Tue Feb 24 23:18:56 2004
+++ 25-akpm/net/core/skbuff.c	Tue Feb 24 23:21:36 2004
@@ -148,6 +148,7 @@ struct sk_buff *alloc_skb(unsigned int s
 	skb->end  = data + size;
 
 	atomic_set(&(skb_shinfo(skb)->dataref), 1);
+	skb_shinfo(skb)->debug  = 0;
 	skb_shinfo(skb)->nr_frags  = 0;
 	skb_shinfo(skb)->tso_size = 0;
 	skb_shinfo(skb)->tso_segs = 0;
@@ -184,6 +185,9 @@ static void skb_clone_fraglist(struct sk
 
 void skb_release_data(struct sk_buff *skb)
 {
+	if (!skb->cloned)
+		WARN_ON(skb_shinfo(skb)->debug != 0);
+
 	if (!skb->cloned ||
 	    atomic_dec_and_test(&(skb_shinfo(skb)->dataref))) {
 		if (skb_shinfo(skb)->nr_frags) {
@@ -320,6 +324,7 @@ struct sk_buff *skb_clone(struct sk_buff
 	C(tail);
 	C(end);
 
+	WARN_ON(skb_shinfo(skb)->debug != 0);
 	atomic_inc(&(skb_shinfo(skb)->dataref));
 	skb->cloned = 1;
 
@@ -526,6 +531,7 @@ int pskb_expand_head(struct sk_buff *skb
 	skb->h.raw   += off;
 	skb->nh.raw  += off;
 	skb->cloned   = 0;
+	skb_shinfo(skb)->debug = 0;
 	atomic_set(&skb_shinfo(skb)->dataref, 1);
 	return 0;
 
_

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:01    [W:1.832 / U:0.420 seconds]
©2003-2008 Jasper Spaans