lkml.org 
[lkml]   [2022]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 01/66] batman-adv: Dont skb_split skbuffs with frag_list
    Date
    From: Sven Eckelmann <sven@narfation.org>

    [ Upstream commit a063f2fba3fa633a599253b62561051ac185fa99 ]

    The receiving interface might have used GRO to receive more fragments than
    MAX_SKB_FRAGS fragments. In this case, these will not be stored in
    skb_shinfo(skb)->frags but merged into the frag list.

    batman-adv relies on the function skb_split to split packets up into
    multiple smaller packets which are not larger than the MTU on the outgoing
    interface. But this function cannot handle frag_list entries and is only
    operating on skb_shinfo(skb)->frags. If it is still trying to split such an
    skb and xmit'ing it on an interface without support for NETIF_F_FRAGLIST,
    then validate_xmit_skb() will try to linearize it. But this fails due to
    inconsistent information. And __pskb_pull_tail will trigger a BUG_ON after
    skb_copy_bits() returns an error.

    In case of entries in frag_list, just linearize the skb before operating on
    it with skb_split().

    Reported-by: Felix Kaechele <felix@kaechele.ca>
    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Tested-by: Felix Kaechele <felix@kaechele.ca>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/batman-adv/fragmentation.c | 11 +++++++++++
    1 file changed, 11 insertions(+)

    diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
    index 1f1f5b0873b2..895d834d479d 100644
    --- a/net/batman-adv/fragmentation.c
    +++ b/net/batman-adv/fragmentation.c
    @@ -478,6 +478,17 @@ int batadv_frag_send_packet(struct sk_buff *skb,
    goto free_skb;
    }

    + /* GRO might have added fragments to the fragment list instead of
    + * frags[]. But this is not handled by skb_split and must be
    + * linearized to avoid incorrect length information after all
    + * batman-adv fragments were created and submitted to the
    + * hard-interface
    + */
    + if (skb_has_frag_list(skb) && __skb_linearize(skb)) {
    + ret = -ENOMEM;
    + goto free_skb;
    + }
    +
    /* Create one header to be copied to all fragments */
    frag_header.packet_type = BATADV_UNICAST_FRAG;
    frag_header.version = BATADV_COMPAT_VERSION;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-05-16 21:53    [W:4.659 / U:0.492 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site