lkml.org 
[lkml]   [2004]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [BUG] 2.6.3 Slab corruption: errors are triggered when memory exceeds 2.5GB (correction)
"David S. Miller" <davem@redhat.com> wrote:
>
> On Wed, 25 Feb 2004 07:21:56 +0100
> Manfred Spraul <manfred@colorfullife.com> wrote:
>
> > 0x620 (1568) is behind the end of the actual eth frame. Who could modify
> > that?
>
> At the end of the SKB data area is where we keep struct skb_shared_info, something
> is messing with the SKB state after a free it appears.
>
> And since it's turning the debugging value 0x6b to 0x6a it must be the
> "atomic_t dataref;" that is being mucked with.

Ah-hah.

This should find it:


25-akpm/include/linux/skbuff.h | 1 +
25-akpm/net/core/dev.c | 1 +
25-akpm/net/core/skbuff.c | 6 ++++++
3 files changed, 8 insertions(+)

diff -puN include/linux/skbuff.h~dataref-debug include/linux/skbuff.h
--- 25/include/linux/skbuff.h~dataref-debug Tue Feb 24 23:18:56 2004
+++ 25-akpm/include/linux/skbuff.h Tue Feb 24 23:19:20 2004
@@ -140,6 +140,7 @@ struct skb_frag_struct {
*/
struct skb_shared_info {
atomic_t dataref;
+ int debug;
unsigned int nr_frags;
unsigned short tso_size;
unsigned short tso_segs;
diff -puN net/core/dev.c~dataref-debug net/core/dev.c
--- 25/net/core/dev.c~dataref-debug Tue Feb 24 23:18:56 2004
+++ 25-akpm/net/core/dev.c Tue Feb 24 23:19:34 2004
@@ -1272,6 +1272,7 @@ int __skb_linearize(struct sk_buff *skb,
/* Set up shinfo */
ninfo = (struct skb_shared_info*)(data + size);
atomic_set(&ninfo->dataref, 1);
+ ninfo->debug = 0;
ninfo->tso_size = skb_shinfo(skb)->tso_size;
ninfo->tso_segs = skb_shinfo(skb)->tso_segs;
ninfo->nr_frags = 0;
diff -puN net/core/skbuff.c~dataref-debug net/core/skbuff.c
--- 25/net/core/skbuff.c~dataref-debug Tue Feb 24 23:18:56 2004
+++ 25-akpm/net/core/skbuff.c Tue Feb 24 23:21:36 2004
@@ -148,6 +148,7 @@ struct sk_buff *alloc_skb(unsigned int s
skb->end = data + size;

atomic_set(&(skb_shinfo(skb)->dataref), 1);
+ skb_shinfo(skb)->debug = 0;
skb_shinfo(skb)->nr_frags = 0;
skb_shinfo(skb)->tso_size = 0;
skb_shinfo(skb)->tso_segs = 0;
@@ -184,6 +185,9 @@ static void skb_clone_fraglist(struct sk

void skb_release_data(struct sk_buff *skb)
{
+ if (!skb->cloned)
+ WARN_ON(skb_shinfo(skb)->debug != 0);
+
if (!skb->cloned ||
atomic_dec_and_test(&(skb_shinfo(skb)->dataref))) {
if (skb_shinfo(skb)->nr_frags) {
@@ -320,6 +324,7 @@ struct sk_buff *skb_clone(struct sk_buff
C(tail);
C(end);

+ WARN_ON(skb_shinfo(skb)->debug != 0);
atomic_inc(&(skb_shinfo(skb)->dataref));
skb->cloned = 1;

@@ -526,6 +531,7 @@ int pskb_expand_head(struct sk_buff *skb
skb->h.raw += off;
skb->nh.raw += off;
skb->cloned = 0;
+ skb_shinfo(skb)->debug = 0;
atomic_set(&skb_shinfo(skb)->dataref, 1);
return 0;

_

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:01    [W:0.353 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site