Commit 3d13008e authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

ip: fix truesize mismatch in ip fragmentation

Special care should be taken when slow path is hit in ip_fragment() :

When walking through frags, we transfert truesize ownership from skb to
frags. Then if we hit a slow_path condition, we must undo this or risk
uncharging frags->truesize twice, and in the end, having negative socket
sk_wmem_alloc counter, or even freeing socket sooner than expected.

Many thanks to Nick Bowler, who provided a very clean bug report and
test program.

Thanks to Jarek for reviewing my first patch and providing a V2

While Nick bisection pointed to commit 2b85a34e (net: No more
expensive sock_hold()/sock_put() on each tx), underlying bug is older
(2.6.12-rc5)

A side effect is to extend work done in commit b2722b1c
(ip_fragment: also adjust skb->truesize for packets not owned by a
socket) to ipv6 as well.
Reported-and-bisected-by: default avatarNick Bowler <nbowler@elliptictech.com>
Tested-by: default avatarNick Bowler <nbowler@elliptictech.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
CC: Jarek Poplawski <jarkao2@gmail.com>
CC: Patrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7e96dc70
...@@ -488,9 +488,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -488,9 +488,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
* we can switch to copy when see the first bad fragment. * we can switch to copy when see the first bad fragment.
*/ */
if (skb_has_frags(skb)) { if (skb_has_frags(skb)) {
struct sk_buff *frag; struct sk_buff *frag, *frag2;
int first_len = skb_pagelen(skb); int first_len = skb_pagelen(skb);
int truesizes = 0;
if (first_len - hlen > mtu || if (first_len - hlen > mtu ||
((first_len - hlen) & 7) || ((first_len - hlen) & 7) ||
...@@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
if (frag->len > mtu || if (frag->len > mtu ||
((frag->len & 7) && frag->next) || ((frag->len & 7) && frag->next) ||
skb_headroom(frag) < hlen) skb_headroom(frag) < hlen)
goto slow_path; goto slow_path_clean;
/* Partially cloned skb? */ /* Partially cloned skb? */
if (skb_shared(frag)) if (skb_shared(frag))
goto slow_path; goto slow_path_clean;
BUG_ON(frag->sk); BUG_ON(frag->sk);
if (skb->sk) { if (skb->sk) {
frag->sk = skb->sk; frag->sk = skb->sk;
frag->destructor = sock_wfree; frag->destructor = sock_wfree;
} }
truesizes += frag->truesize; skb->truesize -= frag->truesize;
} }
/* Everything is OK. Generate! */ /* Everything is OK. Generate! */
...@@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
frag = skb_shinfo(skb)->frag_list; frag = skb_shinfo(skb)->frag_list;
skb_frag_list_init(skb); skb_frag_list_init(skb);
skb->data_len = first_len - skb_headlen(skb); skb->data_len = first_len - skb_headlen(skb);
skb->truesize -= truesizes;
skb->len = first_len; skb->len = first_len;
iph->tot_len = htons(first_len); iph->tot_len = htons(first_len);
iph->frag_off = htons(IP_MF); iph->frag_off = htons(IP_MF);
...@@ -576,6 +574,15 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -576,6 +574,15 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
} }
IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS); IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
return err; return err;
slow_path_clean:
skb_walk_frags(skb, frag2) {
if (frag2 == frag)
break;
frag2->sk = NULL;
frag2->destructor = NULL;
skb->truesize += frag2->truesize;
}
} }
slow_path: slow_path:
......
...@@ -639,7 +639,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -639,7 +639,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
if (skb_has_frags(skb)) { if (skb_has_frags(skb)) {
int first_len = skb_pagelen(skb); int first_len = skb_pagelen(skb);
int truesizes = 0; struct sk_buff *frag2;
if (first_len - hlen > mtu || if (first_len - hlen > mtu ||
((first_len - hlen) & 7) || ((first_len - hlen) & 7) ||
...@@ -651,18 +651,18 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -651,18 +651,18 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
if (frag->len > mtu || if (frag->len > mtu ||
((frag->len & 7) && frag->next) || ((frag->len & 7) && frag->next) ||
skb_headroom(frag) < hlen) skb_headroom(frag) < hlen)
goto slow_path; goto slow_path_clean;
/* Partially cloned skb? */ /* Partially cloned skb? */
if (skb_shared(frag)) if (skb_shared(frag))
goto slow_path; goto slow_path_clean;
BUG_ON(frag->sk); BUG_ON(frag->sk);
if (skb->sk) { if (skb->sk) {
frag->sk = skb->sk; frag->sk = skb->sk;
frag->destructor = sock_wfree; frag->destructor = sock_wfree;
truesizes += frag->truesize;
} }
skb->truesize -= frag->truesize;
} }
err = 0; err = 0;
...@@ -693,7 +693,6 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -693,7 +693,6 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
first_len = skb_pagelen(skb); first_len = skb_pagelen(skb);
skb->data_len = first_len - skb_headlen(skb); skb->data_len = first_len - skb_headlen(skb);
skb->truesize -= truesizes;
skb->len = first_len; skb->len = first_len;
ipv6_hdr(skb)->payload_len = htons(first_len - ipv6_hdr(skb)->payload_len = htons(first_len -
sizeof(struct ipv6hdr)); sizeof(struct ipv6hdr));
...@@ -756,6 +755,15 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) ...@@ -756,6 +755,15 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
IPSTATS_MIB_FRAGFAILS); IPSTATS_MIB_FRAGFAILS);
dst_release(&rt->dst); dst_release(&rt->dst);
return err; return err;
slow_path_clean:
skb_walk_frags(skb, frag2) {
if (frag2 == frag)
break;
frag2->sk = NULL;
frag2->destructor = NULL;
skb->truesize += frag2->truesize;
}
} }
slow_path: slow_path:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment