diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2021-05-11 10:35:21 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-06-03 09:09:45 +0200 |
| commit | 718f5f7cdef1c81406061b5cadbfe487ed7b8389 (patch) | |
| tree | b44bcc1e84a6302400614a281812f80c32ef0d6d /include | |
| parent | 90ee484984b6c6bdbbba32ce21ed2f09ffff98b8 (diff) | |
| download | linux-718f5f7cdef1c81406061b5cadbfe487ed7b8389.tar.gz linux-718f5f7cdef1c81406061b5cadbfe487ed7b8389.tar.bz2 linux-718f5f7cdef1c81406061b5cadbfe487ed7b8389.zip | |
net: really orphan skbs tied to closing sk
[ Upstream commit 098116e7e640ba677d9e345cbee83d253c13d556 ]
If the owing socket is shutting down - e.g. the sock reference
count already dropped to 0 and only sk_wmem_alloc is keeping
the sock alive, skb_orphan_partial() becomes a no-op.
When forwarding packets over veth with GRO enabled, the above
causes refcount errors.
This change addresses the issue with a plain skb_orphan() call
in the critical scenario.
Fixes: 9adc89af724f ("net: let skb_orphan_partial wake-up waiters.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/sock.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index 8487f58da36d..62e3811e95a7 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2225,13 +2225,15 @@ static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk) sk_mem_charge(sk, skb->truesize); } -static inline void skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk) +static inline __must_check bool skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk) { if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) { skb_orphan(skb); skb->destructor = sock_efree; skb->sk = sk; + return true; } + return false; } void sk_reset_timer(struct sock *sk, struct timer_list *timer, |