Commit 3cc0e873 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

[NET]: Warn in __skb_trim if skb is paged

It's better to warn and fail rather than rarely triggering BUG on paths
that incorrectly call skb_trim/__skb_trim on a non-linear skb.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b38dfee3
...@@ -975,15 +975,16 @@ static inline void skb_reserve(struct sk_buff *skb, int len) ...@@ -975,15 +975,16 @@ static inline void skb_reserve(struct sk_buff *skb, int len)
#define NET_SKB_PAD 16 #define NET_SKB_PAD 16
#endif #endif
extern int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc); extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
static inline void __skb_trim(struct sk_buff *skb, unsigned int len) static inline void __skb_trim(struct sk_buff *skb, unsigned int len)
{ {
if (!skb->data_len) { if (unlikely(skb->data_len)) {
WARN_ON(1);
return;
}
skb->len = len; skb->len = len;
skb->tail = skb->data + len; skb->tail = skb->data + len;
} else
___pskb_trim(skb, len, 0);
} }
/** /**
...@@ -993,6 +994,7 @@ static inline void __skb_trim(struct sk_buff *skb, unsigned int len) ...@@ -993,6 +994,7 @@ static inline void __skb_trim(struct sk_buff *skb, unsigned int len)
* *
* Cut the length of a buffer down by removing data from the tail. If * Cut the length of a buffer down by removing data from the tail. If
* the buffer is already under the length specified it is not modified. * the buffer is already under the length specified it is not modified.
* The skb must be linear.
*/ */
static inline void skb_trim(struct sk_buff *skb, unsigned int len) static inline void skb_trim(struct sk_buff *skb, unsigned int len)
{ {
...@@ -1003,12 +1005,10 @@ static inline void skb_trim(struct sk_buff *skb, unsigned int len) ...@@ -1003,12 +1005,10 @@ static inline void skb_trim(struct sk_buff *skb, unsigned int len)
static inline int __pskb_trim(struct sk_buff *skb, unsigned int len) static inline int __pskb_trim(struct sk_buff *skb, unsigned int len)
{ {
if (!skb->data_len) { if (skb->data_len)
skb->len = len; return ___pskb_trim(skb, len);
skb->tail = skb->data+len; __skb_trim(skb, len);
return 0; return 0;
}
return ___pskb_trim(skb, len, 1);
} }
static inline int pskb_trim(struct sk_buff *skb, unsigned int len) static inline int pskb_trim(struct sk_buff *skb, unsigned int len)
......
...@@ -801,12 +801,10 @@ struct sk_buff *skb_pad(struct sk_buff *skb, int pad) ...@@ -801,12 +801,10 @@ struct sk_buff *skb_pad(struct sk_buff *skb, int pad)
return nskb; return nskb;
} }
/* Trims skb to length len. It can change skb pointers, if "realloc" is 1. /* Trims skb to length len. It can change skb pointers.
* If realloc==0 and trimming is impossible without change of data,
* it is BUG().
*/ */
int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc) int ___pskb_trim(struct sk_buff *skb, unsigned int len)
{ {
int offset = skb_headlen(skb); int offset = skb_headlen(skb);
int nfrags = skb_shinfo(skb)->nr_frags; int nfrags = skb_shinfo(skb)->nr_frags;
...@@ -816,7 +814,6 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc) ...@@ -816,7 +814,6 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc)
int end = offset + skb_shinfo(skb)->frags[i].size; int end = offset + skb_shinfo(skb)->frags[i].size;
if (end > len) { if (end > len) {
if (skb_cloned(skb)) { if (skb_cloned(skb)) {
BUG_ON(!realloc);
if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
return -ENOMEM; return -ENOMEM;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment