Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 50269e19 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: add a truesize parameter to skb_add_rx_frag() 



skb_add_rx_frag() API is misleading.

Network skbs built with this helper can use uncharged kernel memory and
eventually stress/crash machine in OOM.

Add a 'truesize' parameter and then fix drivers in followup patches.

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0015e551

drivers/net/usb/cdc-phonet.c

+4 −2
Original line number Diff line number Diff line
@@ -164,12 +164,14 @@ static void rx_complete(struct urb *req) 
				/* Can't use pskb_pull() on page in IRQ */

				memcpy(skb_put(skb, 1), page_address(page), 1);

				skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,

						page, 1, req->actual_length);

						page, 1, req->actual_length,

						req->actual_length);

				page = NULL;

			}

		} else {

			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,

					page, 0, req->actual_length);

					page, 0, req->actual_length,

					req->actual_length);

			page = NULL;

		}

		if (req->actual_length < PAGE_SIZE)

drivers/net/wireless/iwlegacy/3945.c

+2 −1
Original line number Diff line number Diff line
@@ -499,7 +499,8 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb, 
				      le32_to_cpu(rx_end->status), stats);



	skb_add_rx_frag(skb, 0, rxb->page,

			(void *)rx_hdr->payload - (void *)pkt, len);

			(void *)rx_hdr->payload - (void *)pkt, len,

			len);



	il_update_stats(il, false, fc, len);

	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));

drivers/net/wireless/iwlegacy/4965-mac.c

+2 −1
Original line number Diff line number Diff line
@@ -596,7 +596,8 @@ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr, 
		return;

	}



	skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);

	skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len,

			len);



	il_update_stats(il, false, fc, len);

	memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));

drivers/net/wireless/iwlwifi/iwl-agn-rx.c

+1 −1
Original line number Diff line number Diff line
@@ -796,7 +796,7 @@ static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv, 


	offset = (void *)hdr - rxb_addr(rxb);

	p = rxb_steal_page(rxb);

	skb_add_rx_frag(skb, 0, p, offset, len);

	skb_add_rx_frag(skb, 0, p, offset, len, len);



	iwl_update_stats(priv, false, fc, len);

drivers/usb/gadget/f_phonet.c

+1 −1
Original line number Diff line number Diff line
@@ -345,7 +345,7 @@ static void pn_rx_complete(struct usb_ep *ep, struct usb_request *req) 
		}



		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,

				skb->len <= 1, req->actual);

				skb->len <= 1, req->actual, req->actual);

		page = NULL;



		if (req->actual < req->length) { /* Last fragment */