• Eric Dumazet's avatar
    ip: fix truesize mismatch in ip fragmentation · 3d13008e
    Eric Dumazet authored
    Special care should be taken when slow path is hit in ip_fragment() :
    
    When walking through frags, we transfert truesize ownership from skb to
    frags. Then if we hit a slow_path condition, we must undo this or risk
    uncharging frags->truesize twice, and in the end, having negative socket
    sk_wmem_alloc counter, or even freeing socket sooner than expected.
    
    Many thanks to Nick Bowler, who provided a very clean bug report and
    test program.
    
    Thanks to Jarek for reviewing my first patch and providing a V2
    
    While Nick bisection pointed to commit 2b85a34e (net: No more
    expensive sock_hold()/sock_put() on each tx), underlying bug is older
    (2.6.12-rc5)
    
    A side effect is to extend work done in commit b2722b1c
    (ip_fragment: also adjust skb->truesize for packets not owned by a
    socket) to ipv6 as well.
    Reported-and-bisected-by: default avatarNick Bowler <nbowler@elliptictech.com>
    Tested-by: default avatarNick Bowler <nbowler@elliptictech.com>
    Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
    CC: Jarek Poplawski <jarkao2@gmail.com>
    CC: Patrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    3d13008e
ip_output.c 35.8 KB