2 bugs in eql.c (with fixes)

Rumen Svobodnikov (rumen@linux.tu-varna.acad.bg)
Fri, 23 Apr 1999 10:19:47 +0300 (EEST)

Hi. I found two bugs in eql.c (kernel 2.0.35 but i think its the same in
2.0.37preX). Don't know about 2.2.x, eql.c seems different there. The first one
is real (i.e. it hit me): Look at eql.c about line 429:

dev_queue_xmit (skb, slave_dev, 1);
eql->stats->tx_packets++;
slave->bytes_queued += skb->len;

Referencing skb->len after dev_queue_xmit(...) in this case is invalid
because dev_queue_xmit frees the skb and then skb->len points to some random
location of memory which in most cases is what is necessary but in other
cases can be reused for something else and so slave->bytes_queued gets
updated with garbage. This makes eql stop queuing trafic to that slave for
long time if slave->bytes_queued gets added with a very large number.
The fix seems simple - just reorder those operatos:

slave->bytes_queued += skb->len;
dev_queue_xmit (skb, slave_dev, 1);
eql->stats->tx_packets++;

The second bug is more theretical, I don't know whether it can eally
happen and maybe even if it happen its not that bad. Anyway look at line 392

slave_dev = eql_best_slave_dev (eql->queue);
slave = eql_best_slave (eql->queue);

Here eql->queue can change between those two operators, so slave_dev would
end up pointing to one device and slave to another.
A possible fix (untested):

slave = eql_best_slave (eql->queue);
slave_dev = slave->dev;

I hope these fixes are correct and will be included in the next
2.0.37pre

Regards, Rumen

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/