From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754316AbbCFD1y (ORCPT <rfc822;w@1wt.eu>);
	Thu, 5 Mar 2015 22:27:54 -0500
Received: from smtp1.onthe.net.au ([203.22.196.249]:51472 "EHLO
	smtp1.onthe.net.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1753221AbbCFD1w (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Thu, 5 Mar 2015 22:27:52 -0500
Date: Fri, 6 Mar 2015 14:27:44 +1100
From: Chris Dunlop <chris@onthe.net.au>
To: dev@openvswitch.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Xu (Simon) Chen" <xchenum@gmail.com>, Thomas Graf <tgraf@suug.ch>,
        Pravin Shelar <pshelar@nicira.com>, discuss@openvswitch.org
Subject: Re: pskb_expand_head: skb_shared BUG
Message-ID: <20150306032744.GB5800@onthe.net.au>
References: <CAGNyuhWRNgYt=D2rEW_yPh50g-Qu2njH0zLwc4MLzNxG-OYbEw@mail.gmail.com>
 <20150227051330.GA7198@onthe.net.au>
 <20150302004511.GA1500@onthe.net.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150302004511.GA1500@onthe.net.au>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Mar 02, 2015 at 11:45:11AM +1100, Chris Dunlop wrote:
> Heads up...
> 
> We've hit this BUG() in v3.10.70, v3.14.27 and v3.18.7:
> 
> net/core/skbuff.c:
> 1027 int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
> 1028                      gfp_t gfp_mask)
> 1029 {
> 1030         int i;
> 1031         u8 *data;
> 1032         int size = nhead + skb_end_offset(skb) + ntail;
> 1033         long off;
> 1034 
> 1035         BUG_ON(nhead < 0);
> 1036 
> 1037         if (skb_shared(skb))
> 1038                 BUG();             <<< BOOM!!!
> 
> This appears to be a regression in the 3.10.x stable series:
> we've been running for 11 months on v3.10.33 without problem, we
> upgraded to v3.14.27 and hit the BUG(), than again on upgrading
> to v3.18.7, then again after downgrading to v3.10.70. 

Apologies, this was a false alarm.

There was indeed a regression, but it's in the upstream openvswitch code
rather than linux core. (Further details: a sharing of an
otherwise-unshared skb, causing us to hit the BUG() above, introduced in
v2.3, will be fixed in upcoming v2.3.2)

Cheers,

Chris