net: fix up truesize of cloned skb in skb_prepare_for_shift()
Avoid the assumption that ksize(kmalloc(S)) == ksize(kmalloc(S)): when cloning an skb, save and restore truesize after pskb_expand_head(). This can occur if the allocator decides to service an allocation of the same size differently (e.g. use a different size class, or pass the allocation on to KFENCE). Because truesize is used for bookkeeping (such as sk_wmem_queued), a modified truesize of a cloned skb may result in corrupt bookkeeping and relevant warnings (such as in sk_stream_kill_queues()). Link: https://lkml.kernel.org/r/X9JR/J6dMMOy1obu@elver.google.com Reported-by: <syzbot+7b99aafdcc2eedea6178@syzkaller.appspotmail.com> Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Marco Elver <elver@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20210201160420.2826895-1-elver@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
parent
ec99a470
-
mentioned in commit 7582edf2
-
mentioned in commit 5d55a6a4
-
mentioned in commit 7118945c
-
mentioned in commit ec697f7f
-
mentioned in commit 97ff09a7
-
mentioned in commit bf5a58d1
-
mentioned in commit e6af7cb6
-
mentioned in commit fa5f8606
-
mentioned in commit 23629b67
-
mentioned in commit a9a6d302
-
mentioned in commit a903e516
Please register or sign in to comment