Re: Bug 75571

[Cong Wang <cwang@twopensource.com>]

[-- Attachment #1: Type: text/plain, Size: 538 bytes --]

On Sun, May 25, 2014 at 11:20 PM, Alex <d77190@mail.ru> wrote:
> Hello!
> I caught a bug and adviced to post it to this list from
> https://bugzilla.kernel.org/show_bug.cgi?id=75571
>
> I tried ifconfig interfaces down (both tun and ifb) before setting rules
> with no luck. This is new trace from kernel 3.2.59.
>
> [ 2945.851717] skb_under_panic: text:f9ca8566 len:209 put:148
> head:ece89000 data:ece88fce tail:0xece8909f end:0xece89140 dev:tun4177

Could you try the following patch? We need to call skb_cow_head() before
skb_push().

[-- Attachment #2: mirred.diff --]
[-- Type: text/plain, Size: 542 bytes --]

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 4f912c0..35b8b8e 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -156,8 +156,14 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
 		goto out;
 
 	if (!(at & AT_EGRESS)) {
-		if (m->tcfm_ok_push)
+		if (m->tcfm_ok_push) {
+			err = skb_cow_head(skb2, skb2->dev->hard_header_len);
+			if (err) {
+				kfree_skb(skb2);
+				goto out;
+			}
 			skb_push(skb2, skb2->dev->hard_header_len);
+		}
 	}
 
 	/* mirror is always swallowed */