<< | Thread Index | >> ]    [ << | Date Index | >> ]

Subject: [BUG] cipe_xmit doesn't properly recover from 'packet length problem'
From: Lennert Buytenhek <buytenh,AT,gnu,DOT,org>
Date: Thu, 1 Nov 2001 19:01:37 +0100

Hi,

CIPE 1.5.2 has a check for 'packet length problem', which is executed before
tunnel->recursion is increased, but if this check detects an error, it
jumps to tx_error_out, which decrements the reference count, causing the
reference count to go negative and all further traffic over the tunnel to
stall.

Suggested patch attached.

cheers,
Lennert

--- cipe-1.5.2/cipe/output.c.orig       Thu Nov  1 18:38:13 2001
+++ cipe-1.5.2/cipe/output.c    Thu Nov  1 18:40:11 2001
@@ -142,11 +142,11 @@
        if (tunnel->recursion++) {
                printk(KERN_ERR "%s: cipe_xmit reentrance\n", dev->name);
                tunnel->stat.collisions++;
-               goto tx_error_out;
+               goto tx_error_out_recursion;
        }
 #ifndef VER_ETH
        if (skb->protocol != __constant_htons(ETH_P_IP))
-               goto tx_error_out;
+               goto tx_error_out_recursion;
 #endif
 
 #if 0
@@ -159,7 +159,7 @@
             dprintk(DEB_OUT, (KERN_NOTICE "%s: no route\n", dev->name));
             tunnel->stat.tx_carrier_errors++;
             dst_link_failure(skb);
-            goto tx_error_out;
+            goto tx_error_out_recursion;
         }
         if (rt->rt_src!=tunnel->myaddr) {
             printk(KERN_NOTICE "%s: changing my address: %s\n", dev->name,
@@ -328,10 +328,11 @@
 
  tx_error:
         ip_rt_put(rt);
+ tx_error_out_recursion:
+       tunnel->recursion--;
  tx_error_out:
        tunnel->stat.tx_errors++;
        dev_kfree_skb(skb);
-       tunnel->recursion--;
        return 0;
 }
 





<< | Thread Index | >> ]    [ << | Date Index | >> ]