Commit 098116e7 authored by Paolo Abeni's avatar Paolo Abeni Committed by David S. Miller
Browse files

net: really orphan skbs tied to closing sk 



If the owing socket is shutting down - e.g. the sock reference
count already dropped to 0 and only sk_wmem_alloc is keeping
the sock alive, skb_orphan_partial() becomes a no-op.

When forwarding packets over veth with GRO enabled, the above
causes refcount errors.

This change addresses the issue with a plain skb_orphan() call
in the critical scenario.

Fixes: 9adc89af ("net: let skb_orphan_partial wake-up waiters.")
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 440c3247

include/net/sock.h

+3 −1
Original line number Diff line number Diff line
@@ -2231,13 +2231,15 @@ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk) 
	sk_mem_charge(sk, skb->truesize);

}



static inline void skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk)

static inline __must_check bool skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk)

{

	if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {

		skb_orphan(skb);

		skb->destructor = sock_efree;

		skb->sk = sk;

		return true;

	}

	return false;

}



void sk_reset_timer(struct sock *sk, struct timer_list *timer,

net/core/sock.c

+4 −4
Original line number Diff line number Diff line
@@ -2132,9 +2132,9 @@ void skb_orphan_partial(struct sk_buff *skb) 
	if (skb_is_tcp_pure_ack(skb))

		return;



	if (can_skb_orphan_partial(skb))

		skb_set_owner_sk_safe(skb, skb->sk);

	else

	if (can_skb_orphan_partial(skb) && skb_set_owner_sk_safe(skb, skb->sk))

		return;



	skb_orphan(skb);

}

EXPORT_SYMBOL(skb_orphan_partial);