Messages in this thread | | | From | Eric Dumazet <> | Date | Thu, 31 Aug 2023 10:47:21 +0200 | Subject | Re: [PATCH v3] skbuff: skb_segment, Call zero copy functions before using skbuff frags |
| |
On Thu, Aug 31, 2023 at 10:17 AM Mohamed Khalfella <mkhalfella@purestorage.com> wrote: > > Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions > once per nskb") added the call to zero copy functions in skb_segment(). > The change introduced a bug in skb_segment() because skb_orphan_frags() > may possibly change the number of fragments or allocate new fragments > altogether leaving nrfrags and frag to point to the old values. This can > cause a panic with stacktrace like the one below. > >
> In this case calling skb_orphan_frags() updated nr_frags leaving nrfrags > local variable in skb_segment() stale. This resulted in the code hitting > i >= nrfrags prematurely and trying to move to next frag_skb using > list_skb pointer, which was NULL, and caused kernel panic. Move the call > to zero copy functions before using frags and nr_frags. > > Fixes: bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") > Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> > Reported-by: Amit Goyal <agoyal@purestorage.com> > Cc: stable@vger.kernel.org > ---
Reviewed-by: Eric Dumazet <edumazet@google.com>
| |