Beschorner Daniel wrote:
>>I managed to reproduce a crash with ipcomp, will try to fix it later.
>
>
> Yes, I can confirm this.
> After disabling IPComp the crashes went away.
The crash happens in xfrm_bundle_ok when walking the bundle upwards
following xfrm_dst->u.next. The loop should be stopped when
xfrm_dst->u.next == first (the topmost xfrm_dst), but it points to
NULL instead. I'm pretty sure the attached patch is responsible,
it breaks XFRM's assumption that dst->next and xfrm_dst->u.next are
the same pointer and xfrm_dst now shares the next pointer with
rcu_head.next in struct dst_entry.
Eric, could you look into this please?
[NET]: Reorder fields of struct dst_entry
This last patch (but not least :) ) finally moves the next pointer at
the end of struct dst_entry. This permits to perform route cache
lookups with a minimal cost of one cache line per entry, instead of
two.
Both 32bits and 64bits platforms benefit from this new layout.
Signed-off-by: Eric Dumazet <[EMAIL PROTECTED]>
Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
commit 1e19e02ca0c5e33ea73a25127dbe6c3b8fcaac4b
tree 23afba2945a9e09b137b094a868ea176c1e1c800
parent 0c195c3fc4e95a06b0c0017506f074c94af99c35
author Eric Dumazet <[EMAIL PROTECTED]> Fri, 09 Feb 2007 16:26:55 -0800
committer David S. Miller <[EMAIL PROTECTED]> Sat, 10 Feb 2007 23:20:45 -0800
include/net/dst.h | 20 ++++++++++----------
1 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/include/net/dst.h b/include/net/dst.h
index 5d62342..e12a8ce 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -37,14 +37,7 @@ struct sk_buff;
struct dst_entry
{
- union {
- struct dst_entry *next;
- struct rtable *rt_next;
- struct rt6_info *rt6_next;
- struct dn_route *dn_next;
- };
- atomic_t __refcnt; /* client references */
- int __use;
+ struct rcu_head rcu_head;
struct dst_entry *child;
struct net_device *dev;
short error;
@@ -55,7 +48,6 @@ struct dst_entry
#define DST_NOPOLICY 4
#define DST_NOHASH 8
#define DST_BALANCED 0x10
- unsigned long lastuse;
unsigned long expires;
unsigned short header_len; /* more space at head required
*/
@@ -80,8 +72,16 @@ struct dst_entry
#endif
struct dst_ops *ops;
- struct rcu_head rcu_head;
+ unsigned long lastuse;
+ atomic_t __refcnt; /* client references */
+ int __use;
+ union {
+ struct dst_entry *next;
+ struct rtable *rt_next;
+ struct rt6_info *rt6_next;
+ struct dn_route *dn_next;
+ };
char info[0];
};
