Commit 7ebc14d5 authored Jul 05, 2018 by John Fastabend Committed by Alexei Starovoitov Jul 07, 2018

bpf: sockmap, consume_skb in close path



Currently, when a sock is closed and the bpf_tcp_close() callback is
used we remove memory but do not free the skb. Call consume_skb() if
the skb is attached to the buffer.

Reported-by:  <syzbot+d464d2c20c717ef5a6a8@syzkaller.appspotmail.com>
Fixes: 1aa12bdf ("bpf: sockmap, add sock close() hook to remove socks")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent 99ba2b5a

kernel/bpf/sockmap.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -571,6 +571,7 @@ static int free_sg(struct sock sk, int start, struct sk_msg_buff md)
		while (sg[i].length) {
		free += sg[i].length;
		sk_mem_uncharge(sk, sg[i].length);
		if (!md->skb)
		put_page(sg_page(&sg[i]));
		sg[i].length = 0;
		sg[i].page_link = 0;
		@@ -580,6 +581,8 @@ static int free_sg(struct sock sk, int start, struct sk_msg_buff md)
		if (i == MAX_SKB_FRAGS)
		i = 0;
		}
		if (md->skb)
		consume_skb(md->skb);

		return free;
		}