On Tue, Sep 27, 2011 at 02:20:29PM +0300, Sasha Levin wrote: > On Tue, 2011-09-27 at 10:00 +0300, Michael S. Tsirkin wrote: > > > skb = page_to_skb(vi, page, len); > > > ... > > > > Sorry I don't get it yet. Where is mergeable ignored here? > > The NULL deref happens in page_to_skb(), before merge buffers are > handled. The len here is a single buffer length, so for mergeable buffers it is <= the size of the buffer we gave to hardware, which is PAGE_SIZE. err = virtqueue_add_buf_single(vi->rvq, page_address(page), PAGE_SIZE, false, page, gfp); Unless of course we are trying to work around broken hardware again, which I don't have a problem with, but should probably get appropriate comments in code and trigger a warning. > I'll test it and see if it's really the case. > > -- > > Sasha. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html