net: adjust skb->truesize in ___pskb_trim()
Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in
skb_try_coalesce() using syzkaller and a filter attached to a TCP
socket.
As we did recently in commit 158f323b98
("net: adjust skb->truesize in
pskb_expand_head()") we can adjust skb->truesize from ___pskb_trim(),
via a call to skb_condense().
If all frags were freed, then skb->truesize can be recomputed.
This call can be done if skb is not yet owned, or destructor is
sock_edemux().
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7162fb242c
commit
c21b48cc1b
|
@ -1576,6 +1576,8 @@ done:
|
|||
skb_set_tail_pointer(skb, len);
|
||||
}
|
||||
|
||||
if (!skb->sk || skb->destructor == sock_edemux)
|
||||
skb_condense(skb);
|
||||
return 0;
|
||||
}
|
||||
EXPORT_SYMBOL(___pskb_trim);
|
||||
|
|
Loading…
Reference in a new issue