lkml.org 
[lkml]   [2015]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 38/72] RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv
    Date
    From: Sowmini Varadhan <sowmini.varadhan@oracle.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    [ Upstream commit 8ce675ff39b9958d1c10f86cf58e357efaafc856 ]

    Either of pskb_pull() or pskb_trim() may fail under low memory conditions.
    If rds_tcp_data_recv() ignores such failures, the application will
    receive corrupted data because the skb has not been correctly
    carved to the RDS datagram size.

    Avoid this by handling pskb_pull/pskb_trim failure in the same
    manner as the skb_clone failure: bail out of rds_tcp_data_recv(), and
    retry via the deferred call to rds_send_worker() that gets set up on
    ENOMEM from rds_tcp_read_sock()

    Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
    Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    net/rds/tcp_recv.c | 11 +++++++++--
    1 file changed, 9 insertions(+), 2 deletions(-)

    diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
    index 4fac4f2bb9dc..8b33d9967b56 100644
    --- a/net/rds/tcp_recv.c
    +++ b/net/rds/tcp_recv.c
    @@ -234,8 +234,15 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
    }

    to_copy = min(tc->t_tinc_data_rem, left);
    - pskb_pull(clone, offset);
    - pskb_trim(clone, to_copy);
    + if (!pskb_pull(clone, offset) ||
    + pskb_trim(clone, to_copy)) {
    + pr_warn("rds_tcp_data_recv: pull/trim failed "
    + "left %zu data_rem %zu skb_len %d\n",
    + left, tc->t_tinc_data_rem, skb->len);
    + kfree_skb(clone);
    + desc->error = -ENOMEM;
    + goto out;
    + }
    skb_queue_tail(&tinc->ti_skb_list, clone);

    rdsdebug("skb %p data %p len %d off %u to_copy %zu -> "
    --
    2.6.3


    \
     
     \ /
      Last update: 2015-11-23 14:41    [W:4.104 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site