raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

skbuff: skb_segment: orphan frags before copying

Browse Source 
[ Upstream commit 1fd819ecb9 ]

skb_segment copies frags around, so we need
to copy them carefully to avoid accessing
user memory after reporting completion to userspace
through a callback.

skb_segment doesn't normally happen on datapath:
TSO needs to be disabled - so disabling zero copy
in this case does not look like a big deal.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
This commit is contained in:
Michael S. Tsirkin
2014-03-10 19:28:08 +02:00
committed by Jiri Slaby
parent f2a855e3e1
commit 07d054ef67
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
net/core/skbuff.c
View File

@@ -2731,6 +2731,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
skb_frag_t *frag = skb_shinfo(head_skb)->frags; skb_frag_t *frag = skb_shinfo(head_skb)->frags;
unsigned int mss = skb_shinfo(head_skb)->gso_size; unsigned int mss = skb_shinfo(head_skb)->gso_size;
unsigned int doffset = head_skb->data - skb_mac_header(head_skb); unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
struct sk_buff *frag_skb = head_skb;
unsigned int offset = doffset; unsigned int offset = doffset;
unsigned int tnl_hlen = skb_tnl_header_len(head_skb); unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
unsigned int headroom; unsigned int headroom;
@@ -2775,6 +2776,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
i = 0; i = 0;
nfrags = skb_shinfo(list_skb)->nr_frags; nfrags = skb_shinfo(list_skb)->nr_frags;
frag = skb_shinfo(list_skb)->frags; frag = skb_shinfo(list_skb)->frags;
frag_skb = list_skb;
pos += skb_headlen(list_skb); pos += skb_headlen(list_skb);
while (pos < offset + len) { while (pos < offset + len) {
@@ -2869,6 +2871,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
i = 0; i = 0;
nfrags = skb_shinfo(list_skb)->nr_frags; nfrags = skb_shinfo(list_skb)->nr_frags;
frag = skb_shinfo(list_skb)->frags; frag = skb_shinfo(list_skb)->frags;
frag_skb = list_skb;
BUG_ON(!nfrags); BUG_ON(!nfrags);
@@ -2883,6 +2886,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
goto err; goto err;
} }
if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
goto err;
*nskb_frag = *frag; *nskb_frag = *frag;
__skb_frag_ref(nskb_frag); __skb_frag_ref(nskb_frag);
size = skb_frag_size(nskb_frag); size = skb_frag_size(nskb_frag);