Unverified Commit 85569e0b authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8880 net: core: reject skb_copy(_expand) for fraglist GSO skbs 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ziyang Xuan <william.xuanziyang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/COE7JBWASHYUCBFOKDGQO6JWM2NCUUJU/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9U9P7 
 
Link:https://gitee.com/openeuler/kernel/pulls/8880

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents f9191b63 64953cd0

net/core/skbuff.c

+19 −8
Original line number Diff line number Diff line
@@ -1534,11 +1534,17 @@ static inline int skb_alloc_rx_flag(const struct sk_buff *skb) 


struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)

{

	int headerlen = skb_headroom(skb);

	unsigned int size = skb_end_offset(skb) + skb->data_len;

	struct sk_buff *n = __alloc_skb(size, gfp_mask,

					skb_alloc_rx_flag(skb), NUMA_NO_NODE);

	struct sk_buff *n;

	unsigned int size;

	int headerlen;



	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))

		return NULL;



	headerlen = skb_headroom(skb);

	size = skb_end_offset(skb) + skb->data_len;

	n = __alloc_skb(size, gfp_mask,

			skb_alloc_rx_flag(skb), NUMA_NO_NODE);

	if (!n)

		return NULL;
@@ -1799,12 +1805,17 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb, 
	/*

	 *	Allocate the copy buffer

	 */

	struct sk_buff *n = __alloc_skb(newheadroom + skb->len + newtailroom,

					gfp_mask, skb_alloc_rx_flag(skb),

					NUMA_NO_NODE);

	int oldheadroom = skb_headroom(skb);

	int head_copy_len, head_copy_off;

	struct sk_buff *n;

	int oldheadroom;



	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))

		return NULL;



	oldheadroom = skb_headroom(skb);

	n = __alloc_skb(newheadroom + skb->len + newtailroom,

			gfp_mask, skb_alloc_rx_flag(skb),

			NUMA_NO_NODE);

	if (!n)

		return NULL;