Re: Mail delivery failed: returning message to sender

["David S. Miller" <davem@redhat.com>]

   From: Russell King <rmk@arm.linux.org.uk>
   Date: Wed, 21 May 2003 01:21:48 +0100

   fragheaderlen 20 maxfraglen 1802201956 mtu 1802201963
   fragheaderlen 20 maxfraglen 1802201956 mtu 1802201963
   
   The 1802201956 number is rather interesting.  It's 0x6b6b6b6b, which
   seems to be the slab poison-after.

Russel, thanks for the report.

Alexey, when IP redirect happens during UDP sendfile, all things
go to shit. These messages above were generated by a printk
in ip_append_data() right after maxfraglen is computed.

I STRONGLY suspect the *rt = *rth assignment in
route.c:ip_rt_redirect().  In particular this results in
rt->u.dst.path pointing to the old &rth->u.dst, oops.

Russel, please retest using this patch.  This piece of
code needs to be audited further.

--- net/ipv4/route.c.~1~	Tue May 20 17:53:55 2003
+++ net/ipv4/route.c	Tue May 20 17:54:12 2003
@@ -964,6 +964,7 @@
 				rt->u.dst.neighbour	= NULL;
 				rt->u.dst.hh		= NULL;
 				rt->u.dst.obsolete	= 0;
+				rt->u.dst.path		= &rt->u.dst;
 
 				rt->rt_flags		|= RTCF_REDIRECTED;