Re: [RFC/T] [NET] make pskb_expand_head warn when called with invalid state

Johannes Berg
2008-05-05T16:02:00Z

[-- Attachment #1: Type: text/plain, Size: 1445 bytes --]

On Mon, 2008-05-05 at 17:41 +0200, Johannes Berg wrote:
> On Sun, 2008-05-04 at 20:16 +0200, Johannes Berg wrote:
> > This makes pskb_expand_head warn when called when a socket is attached.
>
> > + WARN_ON((nhead || ntail) && skb->sk);
> > +
>
> This is triggering now. I think it's a false positive, trace below.
>
> [23194.608011] Badness at net/core/skbuff.c:726

> [23194.608077] [ccf9bba0] [c02735a0] pskb_expand_head+0x58/0x1f8 (unreliable)
> [23194.608082] [ccf9bbc0] [c02737a4] __pskb_pull_tail+0x64/0x374

It's actually not really a false positive. What is happening is that
__pskb_pull_tail does (follow 'eat'):

/* If skb has not enough free space at tail, get new one
* plus 128 bytes for future expansions. If we have enough
* room at tail, reallocate without expansion only if skb is cloned.
*/
int i, k, eat = (skb->tail + delta) - skb->end;

if (eat > 0 || skb_cloned(skb)) {
if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0,
GFP_ATOMIC))
return NULL;
}

which of course changes the true size of the skb without accounting it
to the socket. Now, the reason this hasn't been known before is that the
data size doesn't change because the stuff that is copied into the
header is removed from the data_len... or something like that, I think.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]