[PATCH net v1 1/2] net: core: check skb_frags_readable before uncloning in skb_copy_ubufs

[Mina Almasry <almasrymina@google.com>]

skb_copy_ubufs drops clones and modifies the SKB via pskb_expand_head()
before checking for !skb_frags_readable(skb). This alters the SKB
geometry prior to throwing an -EFAULT on an invalid SKB. Check
readability first.

Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")

Signed-off-by: Mina Almasry <almasrymina@google.com>
---
Note to sashiko: if you find pre-existing issues, mark them clearly as pre-existing.
---
 net/core/skbuff.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d4382b68d56e0..201c9ec1519c7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2001,12 +2001,12 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
 	int i, order, psize, new_frags;
 	u32 d_off;
 
-	if (skb_shared(skb) || skb_unclone(skb, gfp_mask))
-		return -EINVAL;
-
 	if (!skb_frags_readable(skb))
 		return -EFAULT;
 
+	if (skb_shared(skb) || skb_unclone(skb, gfp_mask))
+		return -EINVAL;
+
 	if (!num_frags)
 		goto release;
 

base-commit: 7cbfb180945ce529608e4d4e24a6d483699fab1e
-- 
2.55.0.766.g2966f0265a-goog