BUG() oops from skb_put() of len=-12, from tcp_sendmsg()

["John Hawkes" <hawkes@xxxxxxxxxxxx>]

Running a mips64 2.4.0+lockmetering kernel on the 32-cpu posix0.engr,
using sources from the CVS tree grabbed on 22 January 01, I was
exercising the system using the IBM synthetic "chat" benchmark (30
"rooms", 10 clients per room, 300 messages per client).

BUG() in skb_over_panic(), called from skb_put(), which is inlined in
tcp_sendmsg().  Note the "len" of a negative byte count: -12.

Not repeatable.

skput:over: ffffffff800f38f4:16128 put:-12 dev:<NULL>kernel BUG at
skbuff.c:93!
Cpu 7 Unable to handle kernel paging request at address 00000000, epc ==
800dac2c, ra == 800dac2c
Oops: 0001
Cpu 7
$0      : 0000000000000000 0000000010001ce0 000000000000001b
0000000000000001
$4      : 000000003f5fd975 c0000000000d84d0 ffffffff801b2e48
00000000000004d0
$8      : 0000000000000316 ffffffff801b17c0 00000000000004d0
ffffffffffffffff
$12     : 000000000000001b 0000000000000000 000000000000000a
ffffffff8015f360
$16     : a8000002639fa280 fffffffffffffff4 0000000000000064
a80000082794c1a0
$20     : a80000026358bfac a80000082794c060 0000000000000000
000000002b51df28
$24     : 0000000000000000 0000000000000020
$28     : a800000d27be0000 a800000d27be3c60 0000000000000064
ffffffff800dac2c
Hi      : 0000000000000000
Lo      : 00000000000004d0
epc     : ffffffff800dac2c
badvaddr: 0000000000000000
badvaddr: 0000000000000000
Status  : 10001ce3
Cause   : 0000800c
Cause   : 0000800c
Process chat_s (pid: 5562, stackpage=a800000d27be0000)
Stack: ffffffff800f38fc ffffffff800f3dbc 7fffffffffffffff
00000000237061a0
             a800000d27be3e58 0000000000000000 00003f0000000000
a80000082794c0a0
             0000000163730000 a800000d27be3cc0 ffffffff8003268c
ffffffff80032638
             ffffffff80044ab0 a80000082794c1a0 a80000082794c060
a800000d27be3e10
             0000000000000064 0000000000000064 0000000000000000
0000000000000064
             ffffffffffffffff 0000000000000230 0000000000004640
ffffffff80113dcc
             0000000000000000 a800000d27be3e10 a800000423ab1510
ffffffff800d723c
             000015ba00000000 0000000000000000 0000000000000000
0000000000000000
             a800000423ab1510 0000000000000000 000000002b51df28
0000000000000000
             ffffffff800d8324 ffffffff800d82a8 a8000003035d69c0
a800000c278ceeec
             a8000003035d69c0 ...
Call Trace:Call Trace: [<800f38fc>] [<800f3dbc>] [<8003268c>]
[<80032638>] [<80044ab0>] [<80113dcc>] [<800d723c>] [<800d8324>]
[<800d82a8>] [<800eb4fc>] [<800213b4>] [<800de51c>] [<800d836c>]
[<80028adc>] [<80028bcc>]
Code:Code: 64a53da0  0c00d8dc  2406005d <ac000000> dfbf0000  03e00008
67bd0010  67bdfff0  0080102d