openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

net: Revert "net: avoid one atomic operation in skb_clone()" 

Not sure what I was thinking, but doing anything after
releasing a refcount is suicidal or/and embarrassing.

By the time we set skb->fclone to SKB_FCLONE_FREE, another cpu
could have released last reference and freed whole skb.

We potentially corrupt memory or trap if CONFIG_DEBUG_PAGEALLOC is set.

Reported-by: Chris Mason <clm@fb.com>
Fixes: ce1a4ea3f1 ("net: avoid one atomic operation in skb_clone()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2014-11-21 11:47:16 -08:00 committed by David S. Miller
parent 892d6eb124
commit e7820e39b7
1 changed files with 6 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
net/core/skbuff.c
View File

@ -552,20 +552,13 @@ static void kfree_skbmem(struct sk_buff *skb)
case SKB_FCLONE_CLONE: case SKB_FCLONE_CLONE:
fclones = container_of(skb, struct sk_buff_fclones, skb2); fclones = container_of(skb, struct sk_buff_fclones, skb2);
/* Warning : We must perform the atomic_dec_and_test() before /* The clone portion is available for
* setting skb->fclone back to SKB_FCLONE_FREE, otherwise * fast-cloning again.
* skb_clone() could set clone_ref to 2 before our decrement.
* Anyway, if we are going to free the structure, no need to
* rewrite skb->fclone.
*/ */
if (atomic_dec_and_test(&fclones->fclone_ref)) { skb->fclone = SKB_FCLONE_FREE;
if (atomic_dec_and_test(&fclones->fclone_ref))
kmem_cache_free(skbuff_fclone_cache, fclones); kmem_cache_free(skbuff_fclone_cache, fclones);
} else {
/* The clone portion is available for
* fast-cloning again.
*/
skb->fclone = SKB_FCLONE_FREE;
}
break; break;
} }
} }
@ -887,11 +880,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
if (skb->fclone == SKB_FCLONE_ORIG && if (skb->fclone == SKB_FCLONE_ORIG &&
n->fclone == SKB_FCLONE_FREE) { n->fclone == SKB_FCLONE_FREE) {
n->fclone = SKB_FCLONE_CLONE; n->fclone = SKB_FCLONE_CLONE;
/* As our fastclone was free, clone_ref must be 1 at this point. atomic_inc(&fclones->fclone_ref);
* We could use atomic_inc() here, but it is faster
* to set the final value.
*/
atomic_set(&fclones->fclone_ref, 2);
} else { } else {
if (skb_pfmemalloc(skb)) if (skb_pfmemalloc(skb))
gfp_mask |= __GFP_MEMALLOC; gfp_mask |= __GFP_MEMALLOC;