Messages in this thread | | | Date | Thu, 7 Jan 2016 13:03:39 +0100 | From | Florian Westphal <> | Subject | Re: [BUG] skb corruption and kernel panic at forwarding with fragmentation |
| |
Konstantin Khlebnikov <koct9i@gmail.com> wrote: > On Thu, Jan 7, 2016 at 2:49 AM, Florian Westphal <fw@strlen.de> wrote: > > ... but it seems that those three are the only affected callers > > of skb_gso_segment (tbf is ok since skb isn't owned by anyone, > > ovs does save/restore already). > > > > I think this patch is the right way, we just need similar > > save/restore in nfqnl_enqueue_packet and xfrm_output_gso(). > > Which CB could be here? at this point skb isn't owned by netlink yet.
inet(6)_skb_parm, nfqnl_enqueue_packet is called via netfilter hooks, skb is owned by ipv4 or ipv6 stack.
> > The latter two can be used by either ipv4 or ipv6 so it might > > be preferable to just save/restore sizeof(struct skb_gso_cb); > > or a union of inet_skb_parm+inet6_skb_parm. > > Or just shift GSO CB and add couple checks like > BUILD_BUG_ON(sizeof(SKB_GSO_CB(skb)->room) < sizeof(*IPCB(skb)));
Right, that works too.
| |