Commit 3d13008e authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ip: fix truesize mismatch in ip fragmentation 



Special care should be taken when slow path is hit in ip_fragment() :

When walking through frags, we transfert truesize ownership from skb to
frags. Then if we hit a slow_path condition, we must undo this or risk
uncharging frags->truesize twice, and in the end, having negative socket
sk_wmem_alloc counter, or even freeing socket sooner than expected.

Many thanks to Nick Bowler, who provided a very clean bug report and
test program.

Thanks to Jarek for reviewing my first patch and providing a V2

While Nick bisection pointed to commit 2b85a34e (net: No more
expensive sock_hold()/sock_put() on each tx), underlying bug is older
(2.6.12-rc5)

A side effect is to extend work done in commit b2722b1c
(ip_fragment: also adjust skb->truesize for packets not owned by a
socket) to ipv6 as well.

Reported-and-bisected-by: default avatarNick Bowler <nbowler@elliptictech.com>
Tested-by: default avatarNick Bowler <nbowler@elliptictech.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
CC: Jarek Poplawski <jarkao2@gmail.com>
CC: Patrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7e96dc70

net/ipv4/ip_output.c

+13 −6
Original line number Diff line number Diff line
@@ -488,9 +488,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 
	 * we can switch to copy when see the first bad fragment.

	 */

	if (skb_has_frags(skb)) {

		struct sk_buff *frag;

		struct sk_buff *frag, *frag2;

		int first_len = skb_pagelen(skb);

		int truesizes = 0;



		if (first_len - hlen > mtu ||

		    ((first_len - hlen) & 7) ||
@@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 
			if (frag->len > mtu ||

			    ((frag->len & 7) && frag->next) ||

			    skb_headroom(frag) < hlen)

			    goto slow_path;

				goto slow_path_clean;



			/* Partially cloned skb? */

			if (skb_shared(frag))

				goto slow_path;

				goto slow_path_clean;



			BUG_ON(frag->sk);

			if (skb->sk) {

				frag->sk = skb->sk;

				frag->destructor = sock_wfree;

			}

			truesizes += frag->truesize;

			skb->truesize -= frag->truesize;

		}



		/* Everything is OK. Generate! */
@@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 
		frag = skb_shinfo(skb)->frag_list;

		skb_frag_list_init(skb);

		skb->data_len = first_len - skb_headlen(skb);

		skb->truesize -= truesizes;

		skb->len = first_len;

		iph->tot_len = htons(first_len);

		iph->frag_off = htons(IP_MF);
@@ -576,6 +574,15 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 
		}

		IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);

		return err;



slow_path_clean:

		skb_walk_frags(skb, frag2) {

			if (frag2 == frag)

				break;

			frag2->sk = NULL;

			frag2->destructor = NULL;

			skb->truesize += frag2->truesize;

		}

	}



slow_path:

net/ipv6/ip6_output.c

+13 −5
Original line number Diff line number Diff line
@@ -639,7 +639,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 


	if (skb_has_frags(skb)) {

		int first_len = skb_pagelen(skb);

		int truesizes = 0;

		struct sk_buff *frag2;



		if (first_len - hlen > mtu ||

		    ((first_len - hlen) & 7) ||
@@ -651,18 +651,18 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 
			if (frag->len > mtu ||

			    ((frag->len & 7) && frag->next) ||

			    skb_headroom(frag) < hlen)

			    goto slow_path;

				goto slow_path_clean;



			/* Partially cloned skb? */

			if (skb_shared(frag))

				goto slow_path;

				goto slow_path_clean;



			BUG_ON(frag->sk);

			if (skb->sk) {

				frag->sk = skb->sk;

				frag->destructor = sock_wfree;

				truesizes += frag->truesize;

			}

			skb->truesize -= frag->truesize;

		}



		err = 0;
@@ -693,7 +693,6 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 


		first_len = skb_pagelen(skb);

		skb->data_len = first_len - skb_headlen(skb);

		skb->truesize -= truesizes;

		skb->len = first_len;

		ipv6_hdr(skb)->payload_len = htons(first_len -

						   sizeof(struct ipv6hdr));
@@ -756,6 +755,15 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 
			      IPSTATS_MIB_FRAGFAILS);

		dst_release(&rt->dst);

		return err;



slow_path_clean:

		skb_walk_frags(skb, frag2) {

			if (frag2 == frag)

				break;

			frag2->sk = NULL;

			frag2->destructor = NULL;

			skb->truesize += frag2->truesize;

		}

	}



slow_path:

CRA Git | Maintained and supported by SUSTech CRA and CCSE