From: [EMAIL PROTECTED] Date: Thu, 3 May 2007 11:53:36 -0700 > When the server drops its connection, NFS client reconnects using the > same socket after disconnecting. If the new connection's SYN,ACK > doesn't contain the TCP timestamp option and the old connection's did, > tp->tcp_header_len is recomputed assuming no timestamp header but > tp->rx_opt.tstamp_ok remains set. Then tcp_build_and_update_options() > adds in a timestamp option past the end of the allocated TCP header, > overwriting TCP data, or when the data is in skb_shinfo(skb)->frags[], > overwriting skb_shinfo(skb) causing a crash soon after. (The issue was > debugged from such a crash.) > > Similarly, wscale_ok and sack_ok also get set based on the SYN,ACK > packet but not reset on disconnect, since they are zeroed out at > initialization. The patch zeroes out the entire tp->rx_opt struct in > tcp_disconnect() to avoid this sort of problem. > > Signed-off-by: Srinivas Aji <[EMAIL PROTECTED]>
Thanks for catching this. It is rare to take advantage of the connect() with AF_UNSPEC feature that allows this. Most applications close the socket and make a new one before connecting again. I'll apply this fix, thanks a lot. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
