iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: really orphan skbs tied to closing sk

Browse Source 
[ Upstream commit 098116e7e640ba677d9e345cbee83d253c13d556 ]

If the owing socket is shutting down - e.g. the sock reference
count already dropped to 0 and only sk_wmem_alloc is keeping
the sock alive, skb_orphan_partial() becomes a no-op.

When forwarding packets over veth with GRO enabled, the above
causes refcount errors.

This change addresses the issue with a plain skb_orphan() call
in the critical scenario.

Fixes: 9adc89af724f ("net: let skb_orphan_partial wake-up waiters.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Paolo Abeni 2021-05-11 10:35:21 +02:00 committed by Greg Kroah-Hartman
parent 694f68527e
commit 41f7f37dde
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
include/net/sock.h
View File

@ -2150,13 +2150,15 @@ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
sk_mem_charge(sk, skb->truesize); sk_mem_charge(sk, skb->truesize);
} }
static inline void skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk) static inline __must_check bool skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk)
{ {
if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) { if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
skb_orphan(skb); skb_orphan(skb);
skb->destructor = sock_efree; skb->destructor = sock_efree;
skb->sk = sk; skb->sk = sk;
return true;
} }
return false;
} }
void sk_reset_timer(struct sock *sk, struct timer_list *timer, void sk_reset_timer(struct sock *sk, struct timer_list *timer,

6
net/core/sock.c
View File

@ -2026,9 +2026,9 @@ void skb_orphan_partial(struct sk_buff *skb)
if (skb_is_tcp_pure_ack(skb)) if (skb_is_tcp_pure_ack(skb))
return; return;
if (can_skb_orphan_partial(skb)) if (can_skb_orphan_partial(skb) && skb_set_owner_sk_safe(skb, skb->sk))
skb_set_owner_sk_safe(skb, skb->sk); return;
else
skb_orphan(skb); skb_orphan(skb);
} }
EXPORT_SYMBOL(skb_orphan_partial); EXPORT_SYMBOL(skb_orphan_partial);