Re: [Xen-devel] BUG in xennet_make_frags with paged skb data

From: Zoltan Kiss
Date: Fri Nov 07 2014 - 07:21:12 EST




On 07/11/14 12:15, Stefan Bader wrote:
On 07.11.2014 12:22, Eric Dumazet wrote:
On Fri, 2014-11-07 at 09:25 +0000, Zoltan Kiss wrote:

Please do not top post.

Hi,

AFAIK in this scenario your skb frag is wrong. The page pointer should
point to the original compound page (not a member of it), and offset
should be set accordingly.
For example, if your compound page is 16K (4 page), then the page
pointer should point to the first page, and if the data starts at the
3rd page, then offset should be >8K

This is not accurate.

This BUG_ON() is wrong.

It should instead be :

BUG_ON(len + offset > PAGE_SIZE<<compound_order(compound_head(page)));

would that not have to be

BUG_ON((page-compound_head(page)*PAGE_SIZE)+offset+len >
PAGE_SIZE<<compound_order(compound_head(page)));

There should be a parentheses around "page-compound_head(page)".

since offset is adjusted to start from the tail page in that case.

splice() code can generate such cases.




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/