From patchwork Wed Feb 4 16:33:43 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Erik Hugne X-Patchwork-Id: 436423 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 5487D140119 for ; Thu, 5 Feb 2015 03:35:50 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966857AbbBDQfq (ORCPT ); Wed, 4 Feb 2015 11:35:46 -0500 Received: from sessmg23.ericsson.net ([193.180.251.45]:53054 "EHLO sessmg23.ericsson.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966683AbbBDQfp (ORCPT ); Wed, 4 Feb 2015 11:35:45 -0500 X-AuditID: c1b4fb2d-f79fc6d000001087-34-54d24a5e1f5d Received: from ESESSHC008.ericsson.se (Unknown_Domain [153.88.253.124]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 2B.FB.04231.E5A42D45; Wed, 4 Feb 2015 17:35:42 +0100 (CET) Received: from haze (153.88.183.153) by smtp.internal.ericsson.com (153.88.183.44) with Microsoft SMTP Server id 14.3.210.2; Wed, 4 Feb 2015 17:35:42 +0100 Date: Wed, 4 Feb 2015 17:33:43 +0100 From: Erik Hugne To: CC: , Subject: skb_try_coalesce and fraglists (bug?) Message-ID: <20150204163343.GA857@haze> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprCLMWRmVeSWpSXmKPExsUyM+JvjW6c16UQg6WPbSy+PD/ObHFsgZjF 4+vXmR2YPc4sOMLu8XmTnMf6LVuZApijuGxSUnMyy1KL9O0SuDK+TlnAWnCJs6Ln2EeWBsZn bF2MnBwSAiYSfc3L2CFsMYkL99YDxbk4hASOMEr8mbCPGcKZzyixdsIZJpAqFgEViQP79oB1 sAloSUx8PhEsLiIgI3G0fwHYVGYBA4njGw+D2cICehKTd89mBrF5BdQlWt/eZ4KwBSVOznzC AlGvI7Fg9yegeg4gW1pi+T8OkLAo0KopJ7eBjRECsu+/nM0+gZF/FpLuWUi6ZyF0L2BkXsUo WpxaXJybbmSsl1qUmVxcnJ+nl5dasokRGIwHt/zW3cG4+rXjIUYBDkYlHl6D7oshQqyJZcWV uYcYpTlYlMR57YwPhQgJpCeWpGanphakFsUXleakFh9iZOLglGpgnJ7QY+FXucnt3OGFWlHn jkerqZz4z3cyWCjD5rSiyxt2LwWZujeNsbKXUy+KBTKUy2y+x10m2/xl90/J6MitdmqNjnpT 3nau4c+PfS17OWuayLPf6VL33/wwC2ifn7rWVXH3XjfdlptzPyh03V2yNGBNg9u9Haqmyqdv FPHc2bfqx7eOgrdSSizFGYmGWsxFxYkADeClJycCAAA= Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org skb_try_coalesce should bail out for a number of reasons, if the target skb is cloned, doesn't have enough room, or if either source or target skb have fraglists. However, it seems that the skb_has_frag_list check is done too late, and a small skb may be copied into the tailroom of the head, even if it has a fraglist. Wouldn't this be more correct? --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 56db472..8d02140 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4056,6 +4056,9 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, if (skb_cloned(to)) return false; + if (skb_has_frag_list(to) || skb_has_frag_list(from)) + return false; + if (len <= skb_tailroom(to)) { if (len) BUG_ON(skb_copy_bits(from, 0, skb_put(to, len), len)); @@ -4063,9 +4066,6 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, return true; } - if (skb_has_frag_list(to) || skb_has_frag_list(from)) - return false; - if (skb_headlen(from) != 0) { struct page *page; unsigned int offset;