Re: [PATCH net] net/packet: check TX_RING fragments before memory accounting

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Eric Dumazet wrote:
> From: Kyle Zeng <kylebot@openai.com>
> 
> tpacket_fill_skb() adds the full non-linear payload length to
> skb->truesize and sk_wmem_alloc before checking MAX_SKB_FRAGS. With
> PACKET_VNET_HDR, userspace can submit a ring-sized frame even when it
> greatly exceeds the device MTU.
> 
> A near-INT_MAX frame can saturate sk_wmem_alloc before the fragment
> loop rejects it. A subsequent refcount_add(0x40000001) can temporarily
> turn REFCOUNT_SATURATED into 1. A concurrent TX completion can then
> drop that apparent last reference and free the still-live packet
> socket before refcount_warn_saturate() restores the counter.
> 
> Check that the remaining payload fits in MAX_SKB_FRAGS pages before
> accounting it. Include the initial page offset in the calculation,
> and move the existing -EFAULT handling out of the fragment loop.
> This preserves the accepted packet sizes and error code while
> preventing an invalid frame from injecting an oversized byte charge.
> 
> Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap")
> Cc: stable@vger.kernel.org
> Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> [edumazet: use net_warn_ratelimited() instead of pr_err(), add a Fixes: tag]
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>

Reviewed-by: Willem de Bruijn <willemb@google.com>