[lkml]   [1999]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject2 bugs in eql.c (with fixes)

    Hi. I found two bugs in eql.c (kernel 2.0.35 but i think its the same in
    2.0.37preX). Don't know about 2.2.x, eql.c seems different there. The first one
    is real (i.e. it hit me): Look at eql.c about line 429:

    dev_queue_xmit (skb, slave_dev, 1);
    slave->bytes_queued += skb->len;

    Referencing skb->len after dev_queue_xmit(...) in this case is invalid
    because dev_queue_xmit frees the skb and then skb->len points to some random
    location of memory which in most cases is what is necessary but in other
    cases can be reused for something else and so slave->bytes_queued gets
    updated with garbage. This makes eql stop queuing trafic to that slave for
    long time if slave->bytes_queued gets added with a very large number.
    The fix seems simple - just reorder those operatos:

    slave->bytes_queued += skb->len;
    dev_queue_xmit (skb, slave_dev, 1);

    The second bug is more theretical, I don't know whether it can eally
    happen and maybe even if it happen its not that bad. Anyway look at line 392

    slave_dev = eql_best_slave_dev (eql->queue);
    slave = eql_best_slave (eql->queue);

    Here eql->queue can change between those two operators, so slave_dev would
    end up pointing to one device and slave to another.
    A possible fix (untested):

    slave = eql_best_slave (eql->queue);
    slave_dev = slave->dev;

    I hope these fixes are correct and will be included in the next

    Regards, Rumen

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:51    [W:0.018 / U:2.132 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site