From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Pravin B Shelar <pshelar@ovn.org>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 12/30] net: Fix zero-copy head len calculation.
Date: Fri, 6 Aug 2021 10:16:50 +0200 [thread overview]
Message-ID: <20210806081113.546372389@linuxfoundation.org> (raw)
In-Reply-To: <20210806081113.126861800@linuxfoundation.org>
From: Pravin B Shelar <pshelar@ovn.org>
[ Upstream commit a17ad0961706244dce48ec941f7e476a38c0e727 ]
In some cases skb head could be locked and entire header
data is pulled from skb. When skb_zerocopy() called in such cases,
following BUG is triggered. This patch fixes it by copying entire
skb in such cases.
This could be optimized incase this is performance bottleneck.
---8<---
kernel BUG at net/core/skbuff.c:2961!
invalid opcode: 0000 [#1] SMP PTI
CPU: 2 PID: 0 Comm: swapper/2 Tainted: G OE 5.4.0-77-generic #86-Ubuntu
Hardware name: OpenStack Foundation OpenStack Nova, BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:skb_zerocopy+0x37a/0x3a0
RSP: 0018:ffffbcc70013ca38 EFLAGS: 00010246
Call Trace:
<IRQ>
queue_userspace_packet+0x2af/0x5e0 [openvswitch]
ovs_dp_upcall+0x3d/0x60 [openvswitch]
ovs_dp_process_packet+0x125/0x150 [openvswitch]
ovs_vport_receive+0x77/0xd0 [openvswitch]
netdev_port_receive+0x87/0x130 [openvswitch]
netdev_frame_hook+0x4b/0x60 [openvswitch]
__netif_receive_skb_core+0x2b4/0xc90
__netif_receive_skb_one_core+0x3f/0xa0
__netif_receive_skb+0x18/0x60
process_backlog+0xa9/0x160
net_rx_action+0x142/0x390
__do_softirq+0xe1/0x2d6
irq_exit+0xae/0xb0
do_IRQ+0x5a/0xf0
common_interrupt+0xf/0xf
Code that triggered BUG:
int
skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
{
int i, j = 0;
int plen = 0; /* length of skb->head fragment */
int ret;
struct page *page;
unsigned int offset;
BUG_ON(!from->head_frag && !hlen);
Signed-off-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skbuff.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2d27aae6d36f..825e6b988003 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2922,8 +2922,11 @@ skb_zerocopy_headlen(const struct sk_buff *from)
if (!from->head_frag ||
skb_headlen(from) < L1_CACHE_BYTES ||
- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS)
+ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) {
hlen = skb_headlen(from);
+ if (!hlen)
+ hlen = from->len;
+ }
if (skb_has_frag_list(from))
hlen = from->len;
--
2.30.2
next prev parent reply other threads:[~2021-08-06 8:21 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-06 8:16 [PATCH 5.10 00/30] 5.10.57-rc1 review Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 01/30] drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser" Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 02/30] Revert "drm/i915: Propagate errors on awaiting already signaled fences" Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 03/30] btrfs: fix race causing unnecessary inode logging during link and rename Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 04/30] btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 05/30] regulator: rtmv20: Fix wrong mask for strobe-polarity-high Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 06/30] regulator: rt5033: Fix n_voltages settings for BUCK and LDO Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 07/30] spi: stm32h7: fix full duplex irq handler handling Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 08/30] ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 09/30] r8152: Fix potential PM refcount imbalance Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 10/30] qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union() Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 11/30] ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend Greg Kroah-Hartman
2021-08-06 8:16 ` Greg Kroah-Hartman [this message]
2021-08-06 8:16 ` [PATCH 5.10 13/30] ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 14/30] ASoC: ti: j721e-evm: Check for not initialized parent_clk_id Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 15/30] efi/mokvar: Reserve the table only if it is in boot services data Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 16/30] nvme: fix nvme_setup_command metadata trace event Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 17/30] drm/amd/display: Fix comparison error in dcn21 DML Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 18/30] drm/amd/display: Fix max vstartup calculation for modes with borders Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 19/30] ACPI: fix NULL pointer dereference Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 20/30] Revert "spi: mediatek: fix fifo rx mode" Greg Kroah-Hartman
2021-08-06 8:16 ` [PATCH 5.10 21/30] Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 22/30] firmware: arm_scmi: Ensure drivers provide a probe function Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 23/30] firmware: arm_scmi: Add delayed response status check Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 24/30] Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 25/30] selftests/bpf: Add a test for ptr_to_map_value on stack for helper access Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 26/30] selftest/bpf: Adjust expected verifier errors Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 27/30] bpf, selftests: Adjust few selftest result_unpriv outcomes Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 28/30] bpf: Update selftests to reflect new error states Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 29/30] bpf, selftests: Adjust few selftest outcomes wrt unreachable code Greg Kroah-Hartman
2021-08-06 8:17 ` [PATCH 5.10 30/30] selftest/bpf: Verifier tests for var-off access Greg Kroah-Hartman
2021-08-06 12:59 ` [PATCH 5.10 00/30] 5.10.57-rc1 review Fox Chen
2021-08-06 13:26 ` Pavel Machek
2021-08-06 18:59 ` Guenter Roeck
2021-08-07 6:42 ` Rudi Heitbaum
2021-08-07 10:39 ` Sudip Mukherjee
2021-08-07 18:33 ` Naresh Kamboju
2021-08-07 19:51 ` Aakash Hemadri
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210806081113.546372389@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=pshelar@ovn.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).