> That makes more sense, good catch Herbert.
quoted text
>=20
> I guess it's the pskb_expand_head() calls done by net/mac80211/tx.c
> I suspect we'll need to orphan early in order to accomodate these
> adjustments, otherwise socket memory buffer allocations will
> be corrupted.
>=20
> Once that is cured, I think we can detect this better, by adding a
> carefully constructed assertion to pskb_expand_head().  Basically, the
> idea is, if "nhead" or "ntail" are non-zero, and there is a socket
> still attached to the SKB, print a warning message.

I'm confused now. I added this patch:

--- everything.orig/net/core/skbuff.c	2008-05-01 13:21:52.000000000 +0200
+++ everything/net/core/skbuff.c	2008-05-01 13:29:57.000000000 +0200
@@ -683,6 +683,14 @@ int pskb_expand_head(struct sk_buff *skb
 	if (!data)
 		goto nodata;
=20
+	if (unlikely((nhead || ntail) && skb->sk)) {
+		printk(KERN_ERR "SKB BUG: Illegal pskb expand (%d:%d) "
+				"with socket attached\n",
+		       nhead, ntail);
+                dump_stack();
+	} else
+		skb->truesize =3D size + sizeof(struct sk_buff);
+
 	/* Copy only real data... and, alas, header. This should be
 	 * optimized for the cases when header is void. */
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
--- everything.orig/net/mac80211/tx.c	2008-05-01 13:01:09.000000000 +0200
+++ everything/net/mac80211/tx.c	2008-05-01 13:16:50.000000000 +0200
@@ -1279,6 +1279,8 @@ int ieee80211_master_start_xmit(struct s
 	int headroom;
 	int ret;
=20
+	skb_orphan(skb);
+
 	if (info->flags & IEEE80211_TX_CTL_READY_FOR_TX) {
 		/*
 		 * We set the IEEE80211_TX_CTL_READY_FOR_TX bit in all skbs
@@ -1581,6 +1583,7 @@ int ieee80211_subif_start_xmit(struct sk
 	 * us broadcast frames. */
=20
 	if (head_need > 0 || skb_cloned(skb)) {
+		skb_orphan(skb);
 #if 0
 		printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
 		       "of headroom\n", dev->name, head_need);


and the assertion never triggers, however I get a number of bugs like this:

=EF=BB=BFSKB BUG: Invalid truesize (4294963740) len=3D44, sizeof(sk_buff)=
=3D176, skb=3D0xeecb6620

and definitely cannot explain that number (-3556).

johannes