Re: kernel BUG at net/core/skbuff.c in linux-2.6.21-rc6

Paul Mackerras
2007-04-14T16:49:31Z

David Miller writes:

> > It seems we fail to reserve enough headroom for the case
> > buf[0] == PPP_ALLSTATIONS and buf[1] != PPP_UI.
> >
> > Can you try this patch please?
>
> Any confirmation of this fix yet?

Indeed, ppp_async doesn't handle that case correctly.

RFC 1662 says:

The Control field is a single octet, which contains the binary
sequence 00000011 (hexadecimal 0x03), the Unnumbered Information
(UI) command with the Poll/Final (P/F) bit set to zero.

The use of other Control field values may be defined at a later
time, or by prior agreement. Frames with unrecognized Control
field values SHOULD be silently discarded.

In what situation were we getting the frames that cause the problem?

I didn't see the patch (the message that this is a reply to is the
first one that I have seen in this thread), so I can't comment on it.

Paul.