Messages in this thread | | | Date | Wed, 7 Jan 2009 14:29:06 +0300 | From | Evgeniy Polyakov <> | Subject | Re: Data corruption issue with splice() on 2.6.27.10 |
| |
Hi Herbert.
On Wed, Jan 07, 2009 at 03:42:32PM +1100, Herbert Xu (herbert@gondor.apana.org.au) wrote: > I see the problem. > > The socket pipes in net/core/skbuff.c use references on the skb > to hold down the memory in skb->head as well as the pages in the > skb. > > Unfortunately, once the pipe is fed into sendpage we only use > page reference counting to pin down the memory. So as soon as > sendpage returns we drop the ref count on the skb, thus freeing > the memory in skb->head, which is yet to be transmitted. > > Moral: Using page reference counts on skb->head is wrong.
That would not happen without scatter-gather support on the interface, date would be plain copied, and after Jarek's requst Willy confirmed that corruption happens with all acceleration being turned off.
-- Evgeniy Polyakov
| |