Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1fd819ec authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by David S. Miller
Browse files

skbuff: skb_segment: orphan frags before copying 



skb_segment copies frags around, so we need
to copy them carefully to avoid accessing
user memory after reporting completion to userspace
through a callback.

skb_segment doesn't normally happen on datapath:
TSO needs to be disabled - so disabling zero copy
in this case does not look like a big deal.

Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1a4cedaf

net/core/skbuff.c

+6 −0
Original line number Diff line number Diff line
@@ -2854,6 +2854,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, 
	skb_frag_t *frag = skb_shinfo(head_skb)->frags;

	unsigned int mss = skb_shinfo(head_skb)->gso_size;

	unsigned int doffset = head_skb->data - skb_mac_header(head_skb);

	struct sk_buff *frag_skb = head_skb;

	unsigned int offset = doffset;

	unsigned int tnl_hlen = skb_tnl_header_len(head_skb);

	unsigned int headroom;
@@ -2898,6 +2899,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, 
			i = 0;

			nfrags = skb_shinfo(list_skb)->nr_frags;

			frag = skb_shinfo(list_skb)->frags;

			frag_skb = list_skb;

			pos += skb_headlen(list_skb);



			while (pos < offset + len) {
@@ -2985,6 +2987,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, 
				i = 0;

				nfrags = skb_shinfo(list_skb)->nr_frags;

				frag = skb_shinfo(list_skb)->frags;

				frag_skb = list_skb;



				BUG_ON(!nfrags);
@@ -2999,6 +3002,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, 
				goto err;

			}



			if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))

				goto err;



			*nskb_frag = *frag;

			__skb_frag_ref(nskb_frag);

			size = skb_frag_size(nskb_frag);