From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Date: Mon, 2 Mar 2015 12:16:52 +1100
From: Chris Dunlop <chris@onthe.net.au>
To: dev@openvswitch.org, linux-kernel@vger.kernel.org,
	stable@vger.kernel.org
Cc: Jiri Benc <jbenc@redhat.com>,
	"Xu (Simon) Chen" <xchenum@gmail.com>, Thomas Graf <tgraf@suug.ch>,
	Pravin Shelar <pshelar@nicira.com>, discuss@openvswitch.org
Subject: Re: pskb_expand_head: skb_shared BUG
Message-ID: <20150302011652.GA4580@onthe.net.au>
References: <CAGNyuhWRNgYt=D2rEW_yPh50g-Qu2njH0zLwc4MLzNxG-OYbEw@mail.gmail.com>
 <20150227051330.GA7198@onthe.net.au>
 <20150302004511.GA1500@onthe.net.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150302004511.GA1500@onthe.net.au>
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Mon, Mar 02, 2015 at 11:45:11AM +1100, Chris Dunlop wrote:
> Heads up...
> 
> We've hit this BUG() in v3.10.70, v3.14.27 and v3.18.7:
> 
> net/core/skbuff.c:
> 1027 int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
> 1028                      gfp_t gfp_mask)
> 1029 {
> 1030         int i;
> 1031         u8 *data;
> 1032         int size = nhead + skb_end_offset(skb) + ntail;
> 1033         long off;
> 1034 
> 1035         BUG_ON(nhead < 0);
> 1036 
> 1037         if (skb_shared(skb))
> 1038                 BUG();             <<< BOOM!!!
> 
> This appears to be a regression in the 3.10.x stable series:
> we've been running for 11 months on v3.10.33 without problem, we
> upgraded to v3.14.27 and hit the BUG(), than again on upgrading
> to v3.18.7, then again after downgrading to v3.10.70. 

I'm guessing this is the cause:

commit 522ad79b7fd042f7f735bf1826f2e5b564d8f015
Author: Jiri Benc <jbenc@redhat.com>
Date:   Thu Aug 21 21:33:44 2014 +0200

    openvswitch: fix panic with multiple vlan headers

 static int make_writable(struct sk_buff *skb, int write_len)
 {
+       if (!pskb_may_pull(skb, write_len))
+               return -ENOMEM;
+
        if (!skb_cloned(skb) || skb_clone_writable(skb, write_len))
                return 0;

...which takes us through:

static inline int pskb_may_pull(struct sk_buff *skb, unsigned int len)
{
        if (likely(len <= skb_headlen(skb)))
                return 1;
        if (unlikely(len > skb->len))
                return 0;
        return __pskb_pull_tail(skb, len - skb_headlen(skb)) != NULL;
}

unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta)
{
        int eat = (skb->tail + delta) - skb->end;
        ...
        if (eat > 0 || skb_cloned(skb)) {
                if (pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0,
                                GFP_ATOMIC))
                        return NULL;
        }
        ...
}

pskb_expand_head(skb, 0, eat > 0 ? eat + 128 : 0, GFP_ATOMIC)
{
        ...
        if (skb_shared(skb))
                BUG();                          <<< BOOM!!!
        ...
}


Cheers,

Chris