skbuff: skb_segment: orphan frags before copying

[ Upstream commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f ]

skb_segment copies frags around, so we need
to copy them carefully to avoid accessing
user memory after reporting completion to userspace
through a callback.

skb_segment doesn't normally happen on datapath:
TSO needs to be disabled - so disabling zero copy
in this case does not look like a big deal.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a12e7da7c7bc3c23e1c486369f35a51573d82ec6..5a60953e6f398617f3b529a8c410c6df3868d70e 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2731,6 +2731,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
        skb_frag_t *frag = skb_shinfo(head_skb)->frags;
        unsigned int mss = skb_shinfo(head_skb)->gso_size;
        unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
+       struct sk_buff *frag_skb = head_skb;
        unsigned int offset = doffset;
        unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
        unsigned int headroom;
@@ -2775,6 +2776,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
                        i = 0;
                        nfrags = skb_shinfo(list_skb)->nr_frags;
                        frag = skb_shinfo(list_skb)->frags;
+                       frag_skb = list_skb;
                        pos += skb_headlen(list_skb);
 
                        while (pos < offset + len) {
@@ -2869,6 +2871,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
                                i = 0;
                                nfrags = skb_shinfo(list_skb)->nr_frags;
                                frag = skb_shinfo(list_skb)->frags;
+                               frag_skb = list_skb;
 
                                BUG_ON(!nfrags);
 
@@ -2883,6 +2886,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
                                goto err;
                        }
 
+                       if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
+                               goto err;
+
                        *nskb_frag = *frag;
                        __skb_frag_ref(nskb_frag);
                        size = skb_frag_size(nskb_frag);