mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 13:22:57 +00:00
net: really orphan skbs tied to closing sk
If the owing socket is shutting down - e.g. the sock reference
count already dropped to 0 and only sk_wmem_alloc is keeping
the sock alive, skb_orphan_partial() becomes a no-op.
When forwarding packets over veth with GRO enabled, the above
causes refcount errors.
This change addresses the issue with a plain skb_orphan() call
in the critical scenario.
Fixes: 9adc89af72
("net: let skb_orphan_partial wake-up waiters.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
440c3247cb
commit
098116e7e6
2 changed files with 7 additions and 5 deletions
|
@ -2231,13 +2231,15 @@ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
|
||||||
sk_mem_charge(sk, skb->truesize);
|
sk_mem_charge(sk, skb->truesize);
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk)
|
static inline __must_check bool skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk)
|
||||||
{
|
{
|
||||||
if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
|
if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
|
||||||
skb_orphan(skb);
|
skb_orphan(skb);
|
||||||
skb->destructor = sock_efree;
|
skb->destructor = sock_efree;
|
||||||
skb->sk = sk;
|
skb->sk = sk;
|
||||||
|
return true;
|
||||||
}
|
}
|
||||||
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
void sk_reset_timer(struct sock *sk, struct timer_list *timer,
|
void sk_reset_timer(struct sock *sk, struct timer_list *timer,
|
||||||
|
|
|
@ -2132,10 +2132,10 @@ void skb_orphan_partial(struct sk_buff *skb)
|
||||||
if (skb_is_tcp_pure_ack(skb))
|
if (skb_is_tcp_pure_ack(skb))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if (can_skb_orphan_partial(skb))
|
if (can_skb_orphan_partial(skb) && skb_set_owner_sk_safe(skb, skb->sk))
|
||||||
skb_set_owner_sk_safe(skb, skb->sk);
|
return;
|
||||||
else
|
|
||||||
skb_orphan(skb);
|
skb_orphan(skb);
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(skb_orphan_partial);
|
EXPORT_SYMBOL(skb_orphan_partial);
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue