lkml.org 
[lkml]   [2014]   [Jul]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 125/125] skbuff: skb_segment: orphan frags before copying
    3.2.61-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "Michael S. Tsirkin" <mst@redhat.com>

    commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f upstream.

    skb_segment copies frags around, so we need
    to copy them carefully to avoid accessing
    user memory after reporting completion to userspace
    through a callback.

    skb_segment doesn't normally happen on datapath:
    TSO needs to be disabled - so disabling zero copy
    in this case does not look like a big deal.

    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.2. As skb_segment() only supports page-frags *or* a
    frag list, there is no need for the additional frag_skb pointer or the
    preparatory renaming.]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    --- a/net/core/skbuff.c
    +++ b/net/core/skbuff.c
    @@ -2698,6 +2698,9 @@ struct sk_buff *skb_segment(struct sk_bu
    skb_put(nskb, hsize), hsize);

    while (pos < offset + len && i < nfrags) {
    + if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
    + goto err;
    +
    *frag = skb_shinfo(skb)->frags[i];
    __skb_frag_ref(frag);
    size = skb_frag_size(frag);


    \
     
     \ /
      Last update: 2014-07-08 22:21    [W:5.415 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site