From patchwork Sun Apr 13 22:57:40 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ben Hutchings X-Patchwork-Id: 338798 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 219F51400E9 for ; Mon, 14 Apr 2014 08:58:05 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751295AbaDMW56 (ORCPT ); Sun, 13 Apr 2014 18:57:58 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:52525 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750958AbaDMW55 (ORCPT ); Sun, 13 Apr 2014 18:57:57 -0400 Received: from deadeye.wl.decadent.org.uk ([192.168.4.249]) by shadbolt.decadent.org.uk with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from ) id 1WZTLS-0006r7-6p; Sun, 13 Apr 2014 23:57:50 +0100 Received: from ben by deadeye.wl.decadent.org.uk with local (Exim 4.82) (envelope-from ) id 1WZTLN-0008MW-4b; Sun, 13 Apr 2014 23:57:45 +0100 Message-ID: <1397429860.10849.86.camel@deadeye.wl.decadent.org.uk> Subject: [PATCH 3.2-3.12] skbuff: skb_segment: orphan frags before copying From: Ben Hutchings To: David Miller Cc: stable@vger.kernel.org, "Michael S. Tsirkin" , Herbert Xu , netdev Date: Sun, 13 Apr 2014 23:57:40 +0100 In-Reply-To: <1397392513.10849.75.camel@deadeye.wl.decadent.org.uk> References: <20140410.215420.576903689381200176.davem@davemloft.net> <1397392513.10849.75.camel@deadeye.wl.decadent.org.uk> X-Mailer: Evolution 3.8.5-2+b3 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 192.168.4.249 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: "Michael S. Tsirkin" commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f upstream. skb_segment copies frags around, so we need to copy them carefully to avoid accessing user memory after reporting completion to userspace through a callback. skb_segment doesn't normally happen on datapath: TSO needs to be disabled - so disabling zero copy in this case does not look like a big deal. Signed-off-by: Michael S. Tsirkin Acked-by: Herbert Xu Signed-off-by: David S. Miller [bwh: Backported to 3.2. As skb_segment() only supports page-frags *or* a frag list, there is no need for the additional frag_skb pointer or the preparatory renaming.] Signed-off-by: Ben Hutchings --- For branches older than 3.6, commit a353e0ce0fd4 ('skbuff: add an api to orphan frags') is needed before this. This is untested and I would appreciate a review. Ben. --- --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2699,6 +2699,9 @@ struct sk_buff *skb_segment(struct sk_bu skb_put(nskb, hsize), hsize); while (pos < offset + len && i < nfrags) { + if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC))) + goto err; + *frag = skb_shinfo(skb)->frags[i]; __skb_frag_ref(frag); size = skb_frag_size(frag);