skb_copy dma_coherent skbs instead of skb_clone
We cannot clone a dma_coherent skb because the instance of struct
skb_shared_info is stored in dma_coherent memory. There is a field
named dataref of type atomic_t in skb_shared_info on which __skb_clone
performs an atomic_inc(). It turned out that atomic operations cannot be
performed on dma_coherent memory because it is mapped non-cachable.
If somebody attempts to clone a dma_coherent skb, just make a deep copy
instead.
skb_clone() is called on dma_coherent skbs when two wifi stations
exchange unicast frames while a packet capturing tool like tcpdump is
running on the netdev.
[<80323b10>] (__skb_clone) from [<80331f5f>] (dev_hard_start_xmit+0xef/0x340)
[<80331f5f>] (dev_hard_start_xmit) from [<8034643b>] (sch_direct_xmit+0x9f/0x170)
[<8034643b>] (sch_direct_xmit) from [<8033231b>] (__dev_queue_xmit+0x16b/0x440)
[<8033231b>] (__dev_queue_xmit) from [<7fafc64f>] (ieee80211_deliver_skb+0xd6/0x160 [mac80211])
[<7fafc64f>] (ieee80211_deliver_skb [mac80211]) from [<7fafdc0f>] (ieee80211_rx_handlers+0xbea/0x1844 [mac80211])
[<7fafdc0f>] (ieee80211_rx_handlers [mac80211]) from [<7fafe985>] (ieee80211_prepare_and_rx_handle+0x11c/0x6b0 [mac80211])
[<7fafe985>] (ieee80211_prepare_and_rx_handle [mac80211]) from [<7faff559>] (ieee80211_rx_napi+0x640/0x6bc [mac80211])
[<7faff559>] (ieee80211_rx_napi [mac80211]) from [<7fba3683>] (ath10k_process_rx+0x172/0x200 [ath10k_core])
[<7fba3683>] (ath10k_process_rx [ath10k_core]) from [<7fba3741>] (ath10k_htt_rx_h_deliver+0x30/0x60 [ath10k_core])
[<7fba3741>] (ath10k_htt_rx_h_deliver [ath10k_core]) from [<7fba3ef9>] (ath10k_htt_txrx_compl_task+0x278/0x8d0 [ath10k_core])
[<7fba3ef9>] (ath10k_htt_txrx_compl_task [ath10k_core]) from [<80023e31>] (tasklet_action+0x7d/0xfc)
[<80023e31>] (tasklet_action) from [<80023553>] (__do_softirq+0xcf/0x2fc)
[<80023553>] (__do_softirq) from [<800239f7>] (irq_exit+0x9f/0xcc)
[<800239f7>] (irq_exit) from [<800510a1>] (__handle_domain_irq+0x69/0xbc)
[<800510a1>] (__handle_domain_irq) from [<80009327>] (gic_handle_irq+0x27/0x54)
[<80009327>] (gic_handle_irq) from [<803fdf7f>] (__irq_svc+0x3f/0x88)
Change-Id: I16a23b587b982d0fe45593ab61a5a4727ba78123
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 084d23e..c24904b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1024,6 +1024,9 @@
if (skb_orphan_frags(skb, gfp_mask))
return NULL;
+ if (skb->dma_coherent)
+ return skb_copy(skb, gfp_mask);
+
if (skb->fclone == SKB_FCLONE_ORIG &&
atomic_read(&fclones->fclone_ref) == 1) {
n = &fclones->skb2;
