From mboxrd@z Thu Jan  1 00:00:00 1970
From: "David S. Miller" <davem@redhat.com>
Subject: Re: Mail delivery failed: returning message to sender
Date: Tue, 20 May 2003 17:55:53 -0700 (PDT)
Sender: netdev-bounce@oss.sgi.com
Message-ID: <20030520.175553.35669773.davem@redhat.com>
References: <20030521012148.P10585@flint.arm.linux.org.uk>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: kuznet@ms2.inr.ac.ru, netdev@oss.sgi.com
Return-path: <netdev-bounce@oss.sgi.com>
To: rmk@arm.linux.org.uk
In-Reply-To: <20030521012148.P10585@flint.arm.linux.org.uk>
Errors-to: netdev-bounce@oss.sgi.com
List-Id: netdev.vger.kernel.org

   From: Russell King <rmk@arm.linux.org.uk>
   Date: Wed, 21 May 2003 01:21:48 +0100

   fragheaderlen 20 maxfraglen 1802201956 mtu 1802201963
   fragheaderlen 20 maxfraglen 1802201956 mtu 1802201963
   
   The 1802201956 number is rather interesting.  It's 0x6b6b6b6b, which
   seems to be the slab poison-after.

Russel, thanks for the report.

Alexey, when IP redirect happens during UDP sendfile, all things
go to shit. These messages above were generated by a printk
in ip_append_data() right after maxfraglen is computed.

I STRONGLY suspect the *rt = *rth assignment in
route.c:ip_rt_redirect().  In particular this results in
rt->u.dst.path pointing to the old &rth->u.dst, oops.

Russel, please retest using this patch.  This piece of
code needs to be audited further.

--- net/ipv4/route.c.~1~	Tue May 20 17:53:55 2003
+++ net/ipv4/route.c	Tue May 20 17:54:12 2003
@@ -964,6 +964,7 @@
 				rt->u.dst.neighbour	= NULL;
 				rt->u.dst.hh		= NULL;
 				rt->u.dst.obsolete	= 0;
+				rt->u.dst.path		= &rt->u.dst;
 
 				rt->rt_flags		|= RTCF_REDIRECTED;