[lkml]   [1999]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject2 bugs in eql.c (with fixes)

Hi. I found two bugs in eql.c (kernel 2.0.35 but i think its the same in
2.0.37preX). Don't know about 2.2.x, eql.c seems different there. The first one
is real (i.e. it hit me): Look at eql.c about line 429:

dev_queue_xmit (skb, slave_dev, 1);
slave->bytes_queued += skb->len;

Referencing skb->len after dev_queue_xmit(...) in this case is invalid
because dev_queue_xmit frees the skb and then skb->len points to some random
location of memory which in most cases is what is necessary but in other
cases can be reused for something else and so slave->bytes_queued gets
updated with garbage. This makes eql stop queuing trafic to that slave for
long time if slave->bytes_queued gets added with a very large number.
The fix seems simple - just reorder those operatos:

slave->bytes_queued += skb->len;
dev_queue_xmit (skb, slave_dev, 1);

The second bug is more theretical, I don't know whether it can eally
happen and maybe even if it happen its not that bad. Anyway look at line 392

slave_dev = eql_best_slave_dev (eql->queue);
slave = eql_best_slave (eql->queue);

Here eql->queue can change between those two operators, so slave_dev would
end up pointing to one device and slave to another.
A possible fix (untested):

slave = eql_best_slave (eql->queue);
slave_dev = slave->dev;

I hope these fixes are correct and will be included in the next

Regards, Rumen

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:51    [W:0.018 / U:2.760 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site