Re: mac80211 truesize bugs

Johannes Berg
2008-05-01T12:06:11Z

[-- Attachment #1: Type: text/plain, Size: 2160 bytes --]

> That makes more sense, good catch Herbert.
>
> I guess it's the pskb_expand_head() calls done by net/mac80211/tx.c
> I suspect we'll need to orphan early in order to accomodate these
> adjustments, otherwise socket memory buffer allocations will
> be corrupted.
>
> Once that is cured, I think we can detect this better, by adding a
> carefully constructed assertion to pskb_expand_head(). Basically, the
> idea is, if "nhead" or "ntail" are non-zero, and there is a socket
> still attached to the SKB, print a warning message.

I'm confused now. I added this patch:

--- everything.orig/net/core/skbuff.c 2008-05-01 13:21:52.000000000 +0200
+++ everything/net/core/skbuff.c 2008-05-01 13:29:57.000000000 +0200
@@ -683,6 +683,14 @@ int pskb_expand_head(struct sk_buff *skb
if (!data)
goto nodata;

+ if (unlikely((nhead || ntail) && skb->sk)) {
+ printk(KERN_ERR "SKB BUG: Illegal pskb expand (%d:%d) "
+ "with socket attached\n",
+ nhead, ntail);
+ dump_stack();
+ } else
+ skb->truesize = size + sizeof(struct sk_buff);
+
/* Copy only real data... and, alas, header. This should be
* optimized for the cases when header is void. */
#ifdef NET_SKBUFF_DATA_USES_OFFSET
--- everything.orig/net/mac80211/tx.c 2008-05-01 13:01:09.000000000 +0200
+++ everything/net/mac80211/tx.c 2008-05-01 13:16:50.000000000 +0200
@@ -1279,6 +1279,8 @@ int ieee80211_master_start_xmit(struct s
int headroom;
int ret;

+ skb_orphan(skb);
+
if (info->flags & IEEE80211_TX_CTL_READY_FOR_TX) {
/*
* We set the IEEE80211_TX_CTL_READY_FOR_TX bit in all skbs
@@ -1581,6 +1583,7 @@ int ieee80211_subif_start_xmit(struct sk
* us broadcast frames. */

if (head_need > 0 || skb_cloned(skb)) {
+ skb_orphan(skb);
#if 0
printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
"of headroom\n", dev->name, head_need);

and the assertion never triggers, however I get a number of bugs like this:

﻿SKB BUG: Invalid truesize (4294963740) len=44, sizeof(sk_buff)=176, skb=0xeecb6620

and definitely cannot explain that number (-3556).