Commit f5ddcbbb authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net-tcp: fastopen: fix high order allocations 



This patch fixes two bugs in fastopen :

1) The tcp_sendmsg(...,  @size) argument was ignored.

   Code was relying on user not fooling the kernel with iovec mismatches

2) When MTU is about 64KB, tcp_send_syn_data() attempts order-5
allocations, which are likely to fail when memory gets fragmented.

Fixes: 783237e8 ("net-tcp: Fast Open client - sending SYN-data")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Acked-by: default avatarYuchung Cheng <ycheng@google.com>
Tested-by: default avatarYuchung Cheng <ycheng@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 68ad785c

include/net/tcp.h

+2 −1
Original line number Diff line number Diff line
@@ -1303,7 +1303,8 @@ struct tcp_fastopen_request { 
	/* Fast Open cookie. Size 0 means a cookie request */

	struct tcp_fastopen_cookie	cookie;

	struct msghdr			*data;  /* data in MSG_FASTOPEN */

	u16				copied;	/* queued in tcp_connect() */

	size_t				size;

	int				copied;	/* queued in tcp_connect() */

};

void tcp_free_fastopen_req(struct tcp_sock *tp);

net/ipv4/tcp.c

+5 −3
Original line number Diff line number Diff line
@@ -1044,7 +1044,8 @@ void tcp_free_fastopen_req(struct tcp_sock *tp) 
	}

}



static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)

static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,

				int *copied, size_t size)

{

	struct tcp_sock *tp = tcp_sk(sk);

	int err, flags;
@@ -1059,11 +1060,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size) 
	if (unlikely(tp->fastopen_req == NULL))

		return -ENOBUFS;

	tp->fastopen_req->data = msg;

	tp->fastopen_req->size = size;



	flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;

	err = __inet_stream_connect(sk->sk_socket, msg->msg_name,

				    msg->msg_namelen, flags);

	*size = tp->fastopen_req->copied;

	*copied = tp->fastopen_req->copied;

	tcp_free_fastopen_req(tp);

	return err;

}
@@ -1083,7 +1085,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 


	flags = msg->msg_flags;

	if (flags & MSG_FASTOPEN) {

		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn);

		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);

		if (err == -EINPROGRESS && copied_syn > 0)

			goto out;

		else if (err)

net/ipv4/tcp_output.c

+6 −1
Original line number Diff line number Diff line
@@ -2908,7 +2908,12 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) 
	space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) -

		MAX_TCP_OPTION_SPACE;



	syn_data = skb_copy_expand(syn, skb_headroom(syn), space,

	space = min_t(size_t, space, fo->size);



	/* limit to order-0 allocations */

	space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));



	syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,

				   sk->sk_allocation);

	if (syn_data == NULL)

		goto fallback;

CRA Git | Maintained and supported by SUSTech CRA and CCSE