Re: bnx2_poll panicking kernel

[David Miller <davem@davemloft.net>]

From: "Aviv Greenberg" <avivgnet@gmail.com>
Date: Thu, 10 Jul 2008 12:45:54 +0300

> On Thu, Jul 10, 2008 at 02:46, David Miller <davem@davemloft.net> wrote:
> >
> > So it has to be something else.
> 
> What mechanism prevents the clone from happening between
> the skb_clone() and skb_split() calls in tcp_fragment?

The TCP packet is guarenteed to be cloned when the driver
first gets it.  That's fundamentally how TCP's retransmission
handling works.

It makes a clone, and sends it down to the driver.

You can't make clones of clones, so in such situations
code makes a full copy instead.

TCP always had the whole state of the retransmit queue,
and thus the base SKB state, locked when it makes all
of these operations.

When TCP is looking at an SKB on the retransmit queue it can only go
from cloned to uncloned, not the other way around.

> Maybe there's a path that doesn't take a lock...

I doubt it.

I think it's some piece of code not making careful enough
checks on the way down to an SKB modification.