Linux Oops on skb_release_data()

Linux Oops on skb_release_data()

[Lewis Adam-CAL022]

[-- Attachment #1.1: Type: text/plain, Size: 1146 bytes --]

Hi,
 
I've written a WLAN driver that I am trying to debug now.  The problem occurs when I send lots of pings, really fast and force the driver to fragment the L3 and above payload.  It will always oops after about 400 pings or so.  When I run the oops through ksymoops, it always points me to skb_release_data(), ultimately the last thing it shows is __free_pages+c/50.
 
I originally thought it was one of my calls to dev_free_skb() on the TX side, but I have since stubbed those out one-by-one to the point where I never call it in my code.  Hence I must believe that it is Linux that is calling it after I pass data up via netif_rx().  
 
My first guess is that the RF on the WLAN might be passing me garbage, so I hard coded some sanity checks in (this is easy since I'm only doing ARP and ping).  Still it crashes, so I am at a loss.  It looks like what I am passing up to the upper layers is good.  The only other variable I can point to is that it seems to do this more when in bridge mode (e.g. I tie eth0 and wlan0 together).  When I do this from wlan0 to wlan0 on (on two stations) it seems to not occur.  
 
Any ideas?
 
Thanks,
Adam

[-- Attachment #1.2: Type: text/html, Size: 2286 bytes --]

[-- Attachment #2: Glacier Bkgrd.jpg --]
[-- Type: image/jpeg, Size: 2743 bytes --]

Re: Linux Oops on skb_release_data()

[Andi Kleen]

> Any ideas?

Most likely you're corrupting memory somewhere, in particular overwrite the boundaries
of the your skb data area. I would suggest to build the kernel with slab debugging
and check all your skb->data accesses.

-Andi