ip: fix truesize mismatch in ip fragmentation
Special care should be taken when slow path is hit in ip_fragment() : When walking through frags, we transfert truesize ownership from skb to frags. Then if we hit a slow_path condition, we must undo this or risk uncharging frags->truesize twice, and in the end, having negative socket sk_wmem_alloc counter, or even freeing socket sooner than expected. Many thanks to Nick Bowler, who provided a very clean bug report and test program. Thanks to Jarek for reviewing my first patch and providing a V2 While Nick bisection pointed to commit2b85a34e91
(net: No more expensive sock_hold()/sock_put() on each tx), underlying bug is older (2.6.12-rc5) A side effect is to extend work done in commitb2722b1c3a
(ip_fragment: also adjust skb->truesize for packets not owned by a socket) to ipv6 as well. Reported-and-bisected-by: Nick Bowler <nbowler@elliptictech.com> Tested-by: Nick Bowler <nbowler@elliptictech.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Jarek Poplawski <jarkao2@gmail.com> CC: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7e96dc7045
commit
3d13008e73
|
@ -488,9 +488,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
* we can switch to copy when see the first bad fragment.
|
* we can switch to copy when see the first bad fragment.
|
||||||
*/
|
*/
|
||||||
if (skb_has_frags(skb)) {
|
if (skb_has_frags(skb)) {
|
||||||
struct sk_buff *frag;
|
struct sk_buff *frag, *frag2;
|
||||||
int first_len = skb_pagelen(skb);
|
int first_len = skb_pagelen(skb);
|
||||||
int truesizes = 0;
|
|
||||||
|
|
||||||
if (first_len - hlen > mtu ||
|
if (first_len - hlen > mtu ||
|
||||||
((first_len - hlen) & 7) ||
|
((first_len - hlen) & 7) ||
|
||||||
|
@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
if (frag->len > mtu ||
|
if (frag->len > mtu ||
|
||||||
((frag->len & 7) && frag->next) ||
|
((frag->len & 7) && frag->next) ||
|
||||||
skb_headroom(frag) < hlen)
|
skb_headroom(frag) < hlen)
|
||||||
goto slow_path;
|
goto slow_path_clean;
|
||||||
|
|
||||||
/* Partially cloned skb? */
|
/* Partially cloned skb? */
|
||||||
if (skb_shared(frag))
|
if (skb_shared(frag))
|
||||||
goto slow_path;
|
goto slow_path_clean;
|
||||||
|
|
||||||
BUG_ON(frag->sk);
|
BUG_ON(frag->sk);
|
||||||
if (skb->sk) {
|
if (skb->sk) {
|
||||||
frag->sk = skb->sk;
|
frag->sk = skb->sk;
|
||||||
frag->destructor = sock_wfree;
|
frag->destructor = sock_wfree;
|
||||||
}
|
}
|
||||||
truesizes += frag->truesize;
|
skb->truesize -= frag->truesize;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Everything is OK. Generate! */
|
/* Everything is OK. Generate! */
|
||||||
|
@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
frag = skb_shinfo(skb)->frag_list;
|
frag = skb_shinfo(skb)->frag_list;
|
||||||
skb_frag_list_init(skb);
|
skb_frag_list_init(skb);
|
||||||
skb->data_len = first_len - skb_headlen(skb);
|
skb->data_len = first_len - skb_headlen(skb);
|
||||||
skb->truesize -= truesizes;
|
|
||||||
skb->len = first_len;
|
skb->len = first_len;
|
||||||
iph->tot_len = htons(first_len);
|
iph->tot_len = htons(first_len);
|
||||||
iph->frag_off = htons(IP_MF);
|
iph->frag_off = htons(IP_MF);
|
||||||
|
@ -576,6 +574,15 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
}
|
}
|
||||||
IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
|
IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
slow_path_clean:
|
||||||
|
skb_walk_frags(skb, frag2) {
|
||||||
|
if (frag2 == frag)
|
||||||
|
break;
|
||||||
|
frag2->sk = NULL;
|
||||||
|
frag2->destructor = NULL;
|
||||||
|
skb->truesize += frag2->truesize;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
slow_path:
|
slow_path:
|
||||||
|
|
|
@ -639,7 +639,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
|
|
||||||
if (skb_has_frags(skb)) {
|
if (skb_has_frags(skb)) {
|
||||||
int first_len = skb_pagelen(skb);
|
int first_len = skb_pagelen(skb);
|
||||||
int truesizes = 0;
|
struct sk_buff *frag2;
|
||||||
|
|
||||||
if (first_len - hlen > mtu ||
|
if (first_len - hlen > mtu ||
|
||||||
((first_len - hlen) & 7) ||
|
((first_len - hlen) & 7) ||
|
||||||
|
@ -651,18 +651,18 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
if (frag->len > mtu ||
|
if (frag->len > mtu ||
|
||||||
((frag->len & 7) && frag->next) ||
|
((frag->len & 7) && frag->next) ||
|
||||||
skb_headroom(frag) < hlen)
|
skb_headroom(frag) < hlen)
|
||||||
goto slow_path;
|
goto slow_path_clean;
|
||||||
|
|
||||||
/* Partially cloned skb? */
|
/* Partially cloned skb? */
|
||||||
if (skb_shared(frag))
|
if (skb_shared(frag))
|
||||||
goto slow_path;
|
goto slow_path_clean;
|
||||||
|
|
||||||
BUG_ON(frag->sk);
|
BUG_ON(frag->sk);
|
||||||
if (skb->sk) {
|
if (skb->sk) {
|
||||||
frag->sk = skb->sk;
|
frag->sk = skb->sk;
|
||||||
frag->destructor = sock_wfree;
|
frag->destructor = sock_wfree;
|
||||||
truesizes += frag->truesize;
|
|
||||||
}
|
}
|
||||||
|
skb->truesize -= frag->truesize;
|
||||||
}
|
}
|
||||||
|
|
||||||
err = 0;
|
err = 0;
|
||||||
|
@ -693,7 +693,6 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
|
|
||||||
first_len = skb_pagelen(skb);
|
first_len = skb_pagelen(skb);
|
||||||
skb->data_len = first_len - skb_headlen(skb);
|
skb->data_len = first_len - skb_headlen(skb);
|
||||||
skb->truesize -= truesizes;
|
|
||||||
skb->len = first_len;
|
skb->len = first_len;
|
||||||
ipv6_hdr(skb)->payload_len = htons(first_len -
|
ipv6_hdr(skb)->payload_len = htons(first_len -
|
||||||
sizeof(struct ipv6hdr));
|
sizeof(struct ipv6hdr));
|
||||||
|
@ -756,6 +755,15 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
|
||||||
IPSTATS_MIB_FRAGFAILS);
|
IPSTATS_MIB_FRAGFAILS);
|
||||||
dst_release(&rt->dst);
|
dst_release(&rt->dst);
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
slow_path_clean:
|
||||||
|
skb_walk_frags(skb, frag2) {
|
||||||
|
if (frag2 == frag)
|
||||||
|
break;
|
||||||
|
frag2->sk = NULL;
|
||||||
|
frag2->destructor = NULL;
|
||||||
|
skb->truesize += frag2->truesize;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
slow_path:
|
slow_path:
|
||||||
|
|
Loading…
Reference in a new issue