summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2017-04-26 18:07:46 +0200
committerDavid S. Miller <davem@davemloft.net>2017-04-28 22:06:47 +0200
commitc21b48cc1bbf2f5af3ef54ada559f7fadf8b508b (patch)
treea350a8306a8b8e0d502d57374aef0967d2944b5f
parenttcp: do not underestimate skb->truesize in tcp_trim_head() (diff)
downloadlinux-c21b48cc1bbf2f5af3ef54ada559f7fadf8b508b.tar.xz
linux-c21b48cc1bbf2f5af3ef54ada559f7fadf8b508b.zip
net: adjust skb->truesize in ___pskb_trim()
Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in skb_try_coalesce() using syzkaller and a filter attached to a TCP socket. As we did recently in commit 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()") we can adjust skb->truesize from ___pskb_trim(), via a call to skb_condense(). If all frags were freed, then skb->truesize can be recomputed. This call can be done if skb is not yet owned, or destructor is sock_edemux(). Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/core/skbuff.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f86bf69cfb8d..f1d04592ace0 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1576,6 +1576,8 @@ done:
skb_set_tail_pointer(skb, len);
}
+ if (!skb->sk || skb->destructor == sock_edemux)
+ skb_condense(skb);
return 0;
}
EXPORT_SYMBOL(___pskb_trim);