On Sun, 1 Sep 2019 16:05:48 -0400 Willem de Bruijn <willemdebruijn.ker...@gmail.com> wrote:
> One quick fix is to disable sg and thus revert to copying in this > case. Not ideal, but better than a kernel splat: > > @@ -3714,6 +3714,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, > sg = !!(features & NETIF_F_SG); > csum = !!can_checksum_protocol(features, proto); > > + if (list_skb && skb_headlen(list_skb) && !list_skb->head_frag) > + sg = false; > + Many thanks Willem for looking into this. Indeed the above suggestion avoids the splat, at least with the reproducer. I'll look deeper into this, to make sure the generated skbs are indeed legit and have correct content. Shmulik
