diff options
| author | Willem de Bruijn <willemb@google.com> | 2017-12-20 23:37:50 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-12-21 21:00:58 +0100 |
| commit | b90ddd568792bcb0054eaf0f61785c8f80c3bd1c (patch) | |
| tree | 15019f6f3ff507c87e3b3d6455a6993489e0d49e /net | |
| parent | skbuff: orphan frags before zerocopy clone (diff) | |
| download | linux-b90ddd568792bcb0054eaf0f61785c8f80c3bd1c.tar.xz linux-b90ddd568792bcb0054eaf0f61785c8f80c3bd1c.zip | |
skbuff: skb_copy_ubufs must release uarg even without user frags
skb_copy_ubufs creates a private copy of frags[] to release its hold
on user frags, then calls uarg->callback to notify the owner.
Call uarg->callback even when no frags exist. This edge case can
happen when zerocopy_sg_from_iter finds enough room in skb_headlen
to copy all the data.
Fixes: 3ece782693c4 ("sock: skb_copy_ubufs support for compound pages")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/skbuff.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index edf40ac0cd07..a3cb0be4c6f3 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1178,7 +1178,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask) u32 d_off; if (!num_frags) - return 0; + goto release; if (skb_shared(skb) || skb_unclone(skb, gfp_mask)) return -EINVAL; @@ -1238,6 +1238,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask) __skb_fill_page_desc(skb, new_frags - 1, head, 0, d_off); skb_shinfo(skb)->nr_frags = new_frags; +release: skb_zcopy_clear(skb, false); return 0; } |