> That makes more sense, good catch Herbert.
>
> I guess it's the pskb_expand_head() calls done by net/mac80211/tx.c
> I suspect we'll need to orphan early in order to accomodate these
> adjustments, otherwise socket memory buffer allocations will
> be corrupted.
>
> Once that is cured, I think we can detect this better, by adding a
> carefully constructed assertion to pskb_expand_head(). Basically, the
> idea is, if "nhead" or "ntail" are non-zero, and there is a socket
> still attached to the SKB, print a warning message.
I'm confused now. I added this patch:
--- everything.orig/net/core/skbuff.c 2008-05-01 13:21:52.000000000 +0200
+++ everything/net/core/skbuff.c 2008-05-01 13:29:57.000000000 +0200
@@ -683,6 +683,14 @@ int pskb_expand_head(struct sk_buff *skb
if (!data)
goto nodata;
+ if (unlikely((nhead || ntail) && skb->sk)) {
+ printk(KERN_ERR "SKB BUG: Illegal pskb expand (%d:%d) "
+ "with socket attached\n",
+ nhead, ntail);
+ dump_stack();
+ } else
+ skb->truesize = size + sizeof(struct sk_buff);
+
/* Copy only real data... and, alas, header. This should be
* optimized for the cases when header is void. */
#ifdef NET_SKBUFF_DATA_USES_OFFSET
--- everything.orig/net/mac80211/tx.c 2008-05-01 13:01:09.000000000 +0200
+++ everything/net/mac80211/tx.c 2008-05-01 13:16:50.000000000 +0200
@@ -1279,6 +1279,8 @@ int ieee80211_master_start_xmit(struct s
int headroom;
int ret;
+ skb_orphan(skb);
+
if (info->flags & IEEE80211_TX_CTL_READY_FOR_TX) {
/*
* We set the IEEE80211_TX_CTL_READY_FOR_TX bit in all skbs
@@ -1581,6 +1583,7 @@ int ieee80211_subif_start_xmit(struct sk
* us broadcast frames. */
if (head_need > 0 || skb_cloned(skb)) {
+ skb_orphan(skb);
#if 0
printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
"of headroom\n", dev->name, head_need);
and the assertion never triggers, however I get a number of bugs like this:
SKB BUG: Invalid truesize (4294963740) len=44, sizeof(sk_buff)=176, skb=0xeecb6620
and definitely cannot explain that number (-3556).
johannes
Attachment:
signature.asc
Description: This is a digitally signed message part
