lkml.org 
[lkml]   [2015]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 007/164] tipc: allow non-linear first fragment buffer
    Date
    3.19.8-ckt11 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jon Paul Maloy <jon.maloy@ericsson.com>

    [ Upstream commit 45c8b7b175ceb2d542e0fe15247377bf3bce29ec ]

    The current code for message reassembly is erroneously assuming that
    the the first arriving fragment buffer always is linear, and then goes
    ahead resetting the fragment list of that buffer in anticipation of
    more arriving fragments.

    However, if the buffer already happens to be non-linear, we will
    inadvertently drop the already attached fragment list, and later
    on trig a BUG() in __pskb_pull_tail().

    We see this happen when running fragmented TIPC multicast across UDP,
    something made possible since
    commit d0f91938bede ("tipc: add ip/udp media type")

    We fix this by not resetting the fragment list when the buffer is non-
    linear, and by initiatlizing our private fragment list tail pointer to
    the tail of the existing fragment list.

    Fixes: commit d0f91938bede ("tipc: add ip/udp media type")
    Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/tipc/msg.c | 12 +++++++++---
    1 file changed, 9 insertions(+), 3 deletions(-)

    diff --git a/net/tipc/msg.c b/net/tipc/msg.c
    index a687b30..2baa992 100644
    --- a/net/tipc/msg.c
    +++ b/net/tipc/msg.c
    @@ -98,7 +98,7 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
    {
    struct sk_buff *head = *headbuf;
    struct sk_buff *frag = *buf;
    - struct sk_buff *tail;
    + struct sk_buff *tail = NULL;
    struct tipc_msg *msg;
    u32 fragid;
    int delta;
    @@ -118,9 +118,15 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
    if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
    goto err;
    head = *headbuf = frag;
    - skb_frag_list_init(head);
    - TIPC_SKB_CB(head)->tail = NULL;
    *buf = NULL;
    + TIPC_SKB_CB(head)->tail = NULL;
    + if (skb_is_nonlinear(head)) {
    + skb_walk_frags(head, tail) {
    + TIPC_SKB_CB(head)->tail = tail;
    + }
    + } else {
    + skb_frag_list_init(head);
    + }
    return 0;
    }

    --
    1.9.1


    \
     
     \ /
      Last update: 2015-12-02 19:21    [W:4.580 / U:0.312 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site