skbuff: fix skb_segment with zero copy skbs
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest5 patches 14 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | skbuff: skb_segment: s/frag/nskb_frag/net/ | +9 | 0 replies | |
| 2/5 | skbuff: skb_segment: s/skb_frag/frag/net/ | +7 | 0 replies | |
| 3/5 | skbuff: skb_segment: s/skb/head_skb/net/ | +24 | 0 replies | |
| 4/5 | skbuff: skb_segment: s/fskb/list_skb/net/ | +13 | 4 replies | |
| 5/5 | skbuff: skb_segment: orphan frags before copyingnet/ | +6 | 9 replies |
Reviews trailers per patch
1 of 5 patches has a Reviewed-by or Acked-by.
| Patch | Herbert Xu |
|---|---|
| 1/5 | |
| 2/5 | |
| 3/5 | |
| 4/5 | |
| 5/5 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs
This fixes a bug in skb_segment where it moves frags between skbs without orphaning them.
This causes userspace to assume it's safe to reuse the buffer, and receiver gets corrupted data. This further might leak information from the transmitter on the wire.
To fix track which skb does a copied frag belong to, and orphan frags when copying them.
As we are tracking multiple skbs here, using
short names (skb,nskb,fskb,skb_frag,frag) becomes confusing. So before adding another one, I refactor these names slightly.
Patch is split out to make it easier to verify that all trasformations are trivially correct.
The problem was observed in the field,
so I think that the patch is necessary on stable as well.
Michael S. Tsirkin (5):
skbuff: skb_segment: s/frag/nskb_frag/
skbuff: skb_segment: s/skb_frag/frag/
skbuff: skb_segment: s/skb/head_skb/
skbuff: skb_segment: s/fskb/list_skb/
skbuff: skb_segment: orphan frags before copying
net/core/skbuff.c | 100 +++++++++++++++++++++++++++++------------------------- 1 file changed, 54 insertions(+), 46 deletions(-)
Signature · 1 line
MST