diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2014-03-10 19:28:08 +0200 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-06-23 10:27:51 +0200 |
| commit | 07d054ef6765b307277f02c11b51f0695d6b3d7c (patch) | |
| tree | 16f1974bad7e567b5e08ae29194890c5a76beab2 | |
| parent | f2a855e3e126a716b71ddf369754f70573b26bce (diff) | |
skbuff: skb_segment: orphan frags before copying
[ Upstream commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f ]
skb_segment copies frags around, so we need
to copy them carefully to avoid accessing
user memory after reporting completion to userspace
through a callback.
skb_segment doesn't normally happen on datapath:
TSO needs to be disabled - so disabling zero copy
in this case does not look like a big deal.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
| -rw-r--r-- | net/core/skbuff.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index a12e7da7c7bc..5a60953e6f39 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2731,6 +2731,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, skb_frag_t *frag = skb_shinfo(head_skb)->frags; unsigned int mss = skb_shinfo(head_skb)->gso_size; unsigned int doffset = head_skb->data - skb_mac_header(head_skb); + struct sk_buff *frag_skb = head_skb; unsigned int offset = doffset; unsigned int tnl_hlen = skb_tnl_header_len(head_skb); unsigned int headroom; @@ -2775,6 +2776,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, i = 0; nfrags = skb_shinfo(list_skb)->nr_frags; frag = skb_shinfo(list_skb)->frags; + frag_skb = list_skb; pos += skb_headlen(list_skb); while (pos < offset + len) { @@ -2869,6 +2871,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, i = 0; nfrags = skb_shinfo(list_skb)->nr_frags; frag = skb_shinfo(list_skb)->frags; + frag_skb = list_skb; BUG_ON(!nfrags); @@ -2883,6 +2886,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, goto err; } + if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC))) + goto err; + *nskb_frag = *frag; __skb_frag_ref(nskb_frag); size = skb_frag_size(nskb_frag); |