请看hard_start_xmit 和netif_rx() 的处理过程。请指点

Question

我想截取ipv6分组，对其进行处理。我看过您的一个项目是在hard_start_xmit处处理，截取函数指针进入自己的函数。我也是这样做的。可是当我生成自己的分组发送的时候，我用ping6 3ffe:192:168:10::201(自己的机子)很正常，可是一旦我ping6别人的机子就死机ping6 3ffe:192:168:10::201。我很多天了就是不明白到底是什么原因。下面是我的代码：务必请您执教一下阿，麻烦你了。
int my_analysis(struct sk_buff *skb, struct net_device *dev)
{      
       if (skb->protocol !=htons(ETH_P_IPV6))
      goto doneout;
       skb_cm->dev=skb->dev;
skb_cm->protocol=htons(ETH_P_AAA);
skb_cm->ip_summed = CHECKSUM_NONE;
skb_cm->pkt_type = skb->pkt_type;
skb_cm->priority = skb->priority;
skb_cm->dst = dst_clone(skb->dst);
skb_cm->csum = 0;
skb_put(skb_cm, len);
skb_cm->mac.raw=skb_cm->data;
memcpy(skb_cm->mac.raw, skb->mac.raw, ETH_HLEN);
eth=(struct ethhdr *)skb_cm->mac.raw;
eth->h_proto=htons(ETH_P_ROHC);
skb_cm->nh.raw=skb_cm->data+ETH_HLEN;
counter=ETH_HLEN;
memcpy(skb_cm->nh.raw, (unsigned char *)ip, ntohs(ip->payload_len));
counter+=(ntohs(ip->payload_len));
data=skb->data;
skb_cm->len=counter;
skb_cm->tail=data+counter;

kfree_skb(skb);
  
return dev_p->back_hard_start_xmit(skb_cm, dev);
doneout:return dev_p->back_hard_start_xmit(skb,dev);
}

同样我为了处理这个数据分组我注册了自己的协议如下
static struct packet_type rohc=
{
    .type=__constant_htons(ETH_P_ROHC),
    .dev=NULL,
    .func=recover,
}
  
我的recover函数如下：
int recover(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt )
{
struct rohc_dev *dev_p;
struct ethhdr *ethernethdr, *eth;
struct rohc_dc_mchn *dc_p;
struct sk_buff *skb_dc;
unsigned char *data;
int counter,len;
struct ipv6hdr *ip;
spinlock_t del_lok=SPIN_LOCK_UNLOCKED;

dev_p= rohc_get_device(dev);

spin_lock(&del_lok);

ethernethdr=(struct ethhdr *)skb->mac.raw;

skb->nh.raw=(unsigned char *)(skb->mac.raw+ETH_HLEN);
ip=(struct ipv6hdr *)skb->nh.raw;
data=skb->mac.raw;
counter=ETH_HLEN;

len=skb->len+40;
skb_dc=alloc_skb(len, GFP_ATOMIC);
if (skb_dc==NULL)
{
  printk("ROHC-DC-IP: there isn`t enough memory for decompression n");
  return -1;
}
skb_dc->dev=skb->dev;
skb_dc->protocol=htons(ETH_P_IPV6);
skb_dc->ip_summed = CHECKSUM_NONE;
skb_dc->pkt_type = skb->pkt_type;
skb_dc->priority = skb->priority;
skb_dc->dst = dst_clone(skb->dst);
skb_dc->csum = 0;
skb_put(skb_dc, len);
skb_dc->mac.raw = skb_dc->data;
memcpy(skb_dc->mac.raw, skb->mac.raw, ETH_HLEN);
eth=(struct ethhdr *)skb_dc->mac.raw;
eth->h_proto=htons(ETH_P_IPV6);
skb_dc->nh.raw=skb_dc->data+ETH_HLEN;
skb_dc->nh.ipv6h=(struct ipv6hdr *)(skb_dc->mac.raw+ETH_HLEN);
data=skb->data+ETH_HLEN;

memcpy(skb_dc->nh.raw, (unsigned char *)ip, ntohs(ip->payload_len)+40);
counter+=(ntohs(ip->payload_len))+40;
skb_dc->tail=skb_dc->mac.raw+counter;
skb_dc->len=counter;

doneout:kfree_skb(skb);
  skb_dc->protocol=htons(ETH_P_IPV6);
  skb_dc->dev=dev;
  netif_rx(skb_dc);
  spin_unlock(&del_lok);
  return 0;
}
可是就是不能够还原回来我的icmp6分组，请问这是什么原因呀，谢谢。

Answer 1

修改skb->data、tail、h.raw等成员必须使用skb封装的函数，如skb_put，skb_reserve，skb_pull，
copy skb使用skb_copy 或者 skb_clone等。当你连这些都没有搞清楚时，死机就没有什么奇怪的了。