Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3cc0e873 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[NET]: Warn in __skb_trim if skb is paged 



It's better to warn and fail rather than rarely triggering BUG on paths
that incorrectly call skb_trim/__skb_trim on a non-linear skb.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b38dfee3

include/linux/skbuff.h

+12 −12
Original line number Diff line number Diff line
@@ -975,15 +975,16 @@ static inline void skb_reserve(struct sk_buff *skb, int len) 
#define NET_SKB_PAD	16

#endif



extern int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc);

extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);



static inline void __skb_trim(struct sk_buff *skb, unsigned int len)

{

	if (!skb->data_len) {

	if (unlikely(skb->data_len)) {

		WARN_ON(1);

		return;

	}

	skb->len  = len;

	skb->tail = skb->data + len;

	} else

		___pskb_trim(skb, len, 0);

}



/**
@@ -993,6 +994,7 @@ static inline void __skb_trim(struct sk_buff *skb, unsigned int len) 
 *

 *	Cut the length of a buffer down by removing data from the tail. If

 *	the buffer is already under the length specified it is not modified.

 *	The skb must be linear.

 */

static inline void skb_trim(struct sk_buff *skb, unsigned int len)

{
@@ -1003,13 +1005,11 @@ static inline void skb_trim(struct sk_buff *skb, unsigned int len) 


static inline int __pskb_trim(struct sk_buff *skb, unsigned int len)

{

	if (!skb->data_len) {

		skb->len  = len;

		skb->tail = skb->data+len;

	if (skb->data_len)

		return ___pskb_trim(skb, len);

	__skb_trim(skb, len);

	return 0;

}

	return ___pskb_trim(skb, len, 1);

}



static inline int pskb_trim(struct sk_buff *skb, unsigned int len)

{

net/core/skbuff.c

+2 −5
Original line number Diff line number Diff line
@@ -801,12 +801,10 @@ struct sk_buff *skb_pad(struct sk_buff *skb, int pad) 
	return nskb;

}	

 

/* Trims skb to length len. It can change skb pointers, if "realloc" is 1.

 * If realloc==0 and trimming is impossible without change of data,

 * it is BUG().

/* Trims skb to length len. It can change skb pointers.

 */



int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc)

int ___pskb_trim(struct sk_buff *skb, unsigned int len)

{

	int offset = skb_headlen(skb);

	int nfrags = skb_shinfo(skb)->nr_frags;
@@ -816,7 +814,6 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc) 
		int end = offset + skb_shinfo(skb)->frags[i].size;

		if (end > len) {

			if (skb_cloned(skb)) {

				BUG_ON(!realloc);

				if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))

					return -ENOMEM;

			}