Re: [PATCH net] tcp: fix skb_copy_ubufs() vs BIG TCP

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

David Ahern wrote:
> On 4/27/23 1:24 PM, Eric Dumazet wrote:
> > David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy
> > using hugepages, and skb length bigger than ~68 KB.
> > 
> > skb_copy_ubufs() assumed it could copy all payload using up to
> > MAX_SKB_FRAGS order-0 pages.
> > 
> > This assumption broke when BIG TCP was able to put up to 512 KB per skb.
> 
> Just an FYI - the problem was triggered at 128kB.
> 
> > 
> > We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45
> > and limit gso_max_size to 180000.
> > 
> > A solution is to use higher order pages if needed.
> > 
> > Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
> > Reported-by: David Ahern <dsahern@kernel.org>
> > Link: https://lore.kernel.org/netdev/c70000f6-baa4-4a05-46d0-4b3e0dc1ccc8@gmail.com/T/
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Cc: Xin Long <lucien.xin@gmail.com>
> > Cc: Willem de Bruijn <willemb@google.com>
> > Cc: Coco Li <lixiaoyan@google.com>
> > ---
> >  net/core/skbuff.c | 20 ++++++++++++++------
> >  1 file changed, 14 insertions(+), 6 deletions(-)
> > 
> 
> 
> Reviewed-by: David Ahern <dsahern@kernel.org>
> Tested-by: David Ahern <dsahern@kernel.org>

Reviewed-by: Willem de Bruijn <willemb@google.com>