• Ilya Dryomov's avatar
    libceph: fall back to sendmsg for slab pages · 3c7f1671
    Ilya Dryomov authored
    commit 7e241f64 upstream.
    
    skb_can_coalesce() allows coalescing neighboring slab objects into
    a single frag:
    
      return page == skb_frag_page(frag) &&
             off == frag->page_offset + skb_frag_size(frag);
    
    ceph_tcp_sendpage() can be handed slab pages.  One example of this is
    XFS: it passes down sector sized slab objects for its metadata I/O.  If
    the kernel client is co-located on the OSD node, the skb may go through
    loopback and pop on the receive side with the exact same set of frags.
    When tcp_recvmsg() attempts to copy out such a frag, hardened usercopy
    complains because the size exceeds the object's allocated size:
    
      usercopy: kernel memory exposure attempt detected from ffff9ba917f20a00 (kmalloc-512) (1024 bytes)
    
    Although skb_can_coalesce() could be taught to return false if the
    resulting frag would cross a slab object boundary, we already have
    a fallback for non-refcounted pages.  Utilize it for slab pages too.
    
    Cc: stable@vger.kernel.org # 4.8+
    Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    3c7f1671
messenger.c 86.6 KB