From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Subject: Re: [PATCH net] net: test tailroom before appending to linear skb Date: Thu, 17 May 2018 09:44:07 -0700 Message-ID: <69013f90-5b09-06e9-b0e4-2869bce6515c@gmail.com> References: <20180517155437.120414-1-willemdebruijn.kernel@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: davem@davemloft.net, Willem de Bruijn To: Willem de Bruijn , netdev@vger.kernel.org Return-path: Received: from mail-yb0-f195.google.com ([209.85.213.195]:35572 "EHLO mail-yb0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752680AbeEQQoM (ORCPT ); Thu, 17 May 2018 12:44:12 -0400 Received: by mail-yb0-f195.google.com with SMTP id j143-v6so1677234ybg.2 for ; Thu, 17 May 2018 09:44:12 -0700 (PDT) In-Reply-To: <20180517155437.120414-1-willemdebruijn.kernel@gmail.com> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 05/17/2018 08:54 AM, Willem de Bruijn wrote: > From: Willem de Bruijn > > Device features may change during transmission. In particular with > corking, a device may toggle scatter-gather in between allocating > and writing to an skb. > > Do not unconditionally assume that !NETIF_F_SG at write time implies > that the same held at alloc time and thus the skb has sufficient > tailroom. > > This issue predates git history. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Reported-by: Eric Dumazet > Signed-off-by: Willem de Bruijn > --- > net/ipv4/ip_output.c | 3 ++- > net/ipv6/ip6_output.c | 3 ++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c > index 83c73bab2c3d..c15204ec2eb0 100644 > --- a/net/ipv4/ip_output.c > +++ b/net/ipv4/ip_output.c > @@ -1045,7 +1045,8 @@ static int __ip_append_data(struct sock *sk, > if (copy > length) > copy = length; > > - if (!(rt->dst.dev->features&NETIF_F_SG)) { > + if (!(rt->dst.dev->features&NETIF_F_SG) && > + skb_tailroom(skb) > copy) { On second thought, maybe use >= for the test ? > unsigned int off; > > off = skb->len; > diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c > index 2e891d2c30ef..7b6d1689087b 100644 > --- a/net/ipv6/ip6_output.c > +++ b/net/ipv6/ip6_output.c > @@ -1503,7 +1503,8 @@ static int __ip6_append_data(struct sock *sk, > if (copy > length) > copy = length; > > - if (!(rt->dst.dev->features&NETIF_F_SG)) { > + if (!(rt->dst.dev->features&NETIF_F_SG) && > + skb_tailroom(skb) >= copy) { > unsigned int off; > > off = skb->len; >