[MPTCP] [PATCH 3/3] imptcp: properly detect skb collapsing

[MPTCP] [PATCH 3/3] imptcp: properly detect skb collapsing

[Paolo Abeni]

[-- Attachment #1: Type: text/plain, Size: 1692 bytes --]

Currently we can misdetect skb collapsing, which will lead
to a kernel warning and crash.

Changing a bit the detection logic for skb collapsing we
can address the issue.

Squash-to: "mptcp: allow collapsing consecutive sendpages on the same substream"
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
---
 net/mptcp/protocol.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 1c489eccdb58..ba918c4fdcc8 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -107,8 +107,8 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
 	struct mptcp_sock *msk = mptcp_sk(sk);
 	bool collapsed, can_collapse = false;
 	struct mptcp_ext *mpext = NULL;
+	struct sk_buff *skb, *tail;
 	struct page_frag *pfrag;
-	struct sk_buff *skb;
 	size_t psize;
 
 	/* use the mptcp page cache so that we can easily move the data
@@ -165,10 +165,16 @@ static int mptcp_sendmsg_frag(struct sock *sk, struct sock *ssk,
 	if (unlikely(ret < psize))
 		iov_iter_revert(&msg->msg_iter, psize - ret);
 
-	collapsed = skb == tcp_write_queue_tail(ssk);
+	/* if the tail skb extension is still the cached one, collapsing
+	 * really happened. Note: we can't check for 'same skb' as the sk_buff
+	 * hdr on tail can be transmitted, freed and re-allocated by the
+	 * do_tcp_sendpages() call
+	 */
+	tail = tcp_write_queue_tail(ssk);
+	collapsed = mpext &&
+		    mpext == (tail ? skb_ext_find(tail, SKB_EXT_MPTCP) : NULL);
 	if (collapsed) {
 		WARN_ON_ONCE(!can_collapse);
-		/* when collapsing mpext always exists */
 		mpext->data_len += ret;
 		goto out;
 	}
-- 
2.21.0