Skip to contentSkip to conversation

net: test tailroom before appending to linear skb

PATCH In review Willem de Bruijn 3 participants 3 messages May 17, 2018

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Willem de Bruijn

author
#0 lore raw

PATCH v2 1/1 net: test tailroom before appending to linear skb

From: Willem de Bruijn <[email protected]>

Device features may change during transmission. In particular with corking, a device may toggle scatter-gather in between allocating and writing to an skb.

Do not unconditionally assume that !NETIF_F_SG at write time implies that the same held at alloc time and thus the skb has sufficient tailroom.

This issue predates git history.

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by Eric Dumazet <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>

---

v2: fix ipv4 boundary condition

---
 net/ipv4/ip_output.c  | 3 ++-
 net/ipv6/ip6_output.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)
net/ipv4/ip_output.c +2 -1
index 83c73bab2c3d..d54abc097800 100644
@@ -1045,7 +1045,8 @@ static int __ip_append_data(struct sock *sk,
 		if (copy > length)
 			copy = length;
 
-		if (!(rt->dst.dev->features&NETIF_F_SG)) {
+		if (!(rt->dst.dev->features&NETIF_F_SG) &&
+		    skb_tailroom(skb) >= copy) {
 			unsigned int off;
 
 			off = skb->len;
net/ipv6/ip6_output.c +2 -1
index 2e891d2c30ef..7b6d1689087b 100644
@@ -1503,7 +1503,8 @@ static int __ip6_append_data(struct sock *sk,
 		if (copy > length)
 			copy = length;
 
-		if (!(rt->dst.dev->features&NETIF_F_SG)) {
+		if (!(rt->dst.dev->features&NETIF_F_SG) &&
+		    skb_tailroom(skb) >= copy) {
 			unsigned int off;
 
 			off = skb->len;
Signature · 1 line
2.17.0.441.gb46fe60e1d-goog
Reviewed-by on v2 1/1
#1 lore raw
Quoted 10 lines · Willem de Bruijn

From: Willem de Bruijn <[email protected]>

Device features may change during transmission. In particular with corking, a device may toggle scatter-gather in between allocating and writing to an skb.

Do not unconditionally assume that !NETIF_F_SG at write time implies that the same held at alloc time and thus the skb has sufficient tailroom.

Quoted 6 lines

This issue predates git history.

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by Eric Dumazet <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>
Reviewed-by Eric Dumazet <[email protected]>
maintainer
#2 lore raw
In reply to Willem de Bruijn

From: Willem de Bruijn <[email protected]>
Date: Thu, 17 May 2018 13:13:29 -0400

Quoted 12 lines

From: Willem de Bruijn <[email protected]>

Device features may change during transmission. In particular with corking, a device may toggle scatter-gather in between allocating and writing to an skb.

Do not unconditionally assume that !NETIF_F_SG at write time implies that the same held at alloc time and thus the skb has sufficient tailroom.

This issue predates git history.

Quoted 7 lines
Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by Eric Dumazet <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>

---

v2: fix ipv4 boundary condition

Applied and queued up for -stable, thanks Willem.