On Tue, 2011-09-27 at 15:37 +0300, Michael S. Tsirkin wrote: > On Tue, Sep 27, 2011 at 02:20:29PM +0300, Sasha Levin wrote: > > On Tue, 2011-09-27 at 10:00 +0300, Michael S. Tsirkin wrote: > > > > skb = page_to_skb(vi, page, len); > > > > ... > > > > > > Sorry I don't get it yet. Where is mergeable ignored here? > > > > The NULL deref happens in page_to_skb(), before merge buffers are > > handled. > > The len here is a single buffer length, so for mergeable > buffers it is <= the size of the buffer we gave to hardware, > which is PAGE_SIZE. > > err = virtqueue_add_buf_single(vi->rvq, page_address(page), > PAGE_SIZE, false, page, gfp); > > > Unless of course we are trying to work around broken hardware again, > which I don't have a problem with, but should probably > get appropriate comments in code and trigger a warning. > > > I'll test it and see if it's really the case. I've verified it with VIRTIO_NET_F_MRG_RXBUF set, and we still get the NULL deref. -- Sasha. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
