linux-stable.git/net/core/skbuff.c, branch linux-3.13.y

skbuff: skb_segment: orphan frags before copying

2014-04-14T13:47:19+00:00

[ Upstream commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f ]

skb_segment copies frags around, so we need
to copy them carefully to avoid accessing
user memory after reporting completion to userspace
through a callback.

skb_segment doesn't normally happen on datapath:
TSO needs to be disabled - so disabling zero copy
in this case does not look like a big deal.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Herbert Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

skbuff: skb_segment: s/fskb/list_skb/

2014-04-14T13:47:19+00:00

[ Upstream commit 1a4cedaf65491e66e1e55b8428c89209da729209 ]

fskb is unrelated to frag: it's coming from
frag_list. Rename it list_skb to avoid confusion.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

skbuff: skb_segment: s/skb/head_skb/

2014-04-14T13:47:19+00:00

[ Upstream commit df5771ffefb13f8af5392bd54fd7e2b596a3a357 ]

rename local variable to make it easier to tell at a glance that we are
dealing with a head skb.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

skbuff: skb_segment: s/skb_frag/frag/

2014-04-14T13:47:19+00:00

[ Upstream commit 4e1beba12d094c6c761ba5c49032b9b9e46380e8 ]

skb_frag can in fact point at either skb
or fskb so rename it generally "frag".

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

skbuff: skb_segment: s/frag/nskb_frag/

2014-04-14T13:47:19+00:00

[ Upstream commit 8cb19905e9287a93ce7c2cbbdf742a060b00e219 ]

frag points at nskb, so name it appropriately

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: add and use skb_gso_transport_seglen()

2014-03-07T06:06:14+00:00

commit de960aa9ab4decc3304959f69533eef64d05d8e8 upstream.

This moves part of Eric Dumazets skb_gso_seglen helper from tbf sched to
skbuff core so it may be reused by upcoming ip forwarding path patch.

Signed-off-by: Florian Westphal 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

fuse: fix pipe_buf_operations

2014-02-13T21:55:27+00:00

commit 28a625cbc2a14f17b83e47ef907b2658576a32aa upstream.

Having this struct in module memory could Oops when if the module is
unloaded while the buffer still persists in a pipe.

Since sock_pipe_buf_ops is essentially the same as fuse_dev_pipe_buf_steal
merge them into nosteal_pipe_buf_ops (this is the same as
default_pipe_buf_ops except stealing the page from the buffer is not
allowed).

Reported-by: Al Viro 
Signed-off-by: Miklos Szeredi 
Signed-off-by: Greg Kroah-Hartman

net: clear local_df when passing skb between namespaces

2013-12-06T04:42:38+00:00

We must clear local_df when passing the skb between namespaces as the
packet is not local to the new namespace any more and thus may not get
fragmented by local rules. Fred Templin noticed that other namespaces
do fragment IPv6 packets while forwarding. Instead they should have send
back a PTB.

The same problem should be present when forwarding DF-IPv4 packets
between namespaces.

Reported-by: Templin, Fred L 
Signed-off-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

gso: handle new frag_list of frags GRO packets

2013-11-21T19:11:50+00:00

Recently GRO started generating packets with frag_lists of frags.
This was not handled by GSO, thus leading to a crash.

Thankfully these packets are of a regular form and are easy to
handle.  This patch handles them in two ways.  For completely
non-linear frag_list entries, we simply continue to iterate over
the frag_list frags once we exhaust the normal frags.  For frag_list
entries with linear parts, we call pskb_trim on the first part
of the frag_list skb, and then process the rest of the frags in
the usual way.

This patch also kills a chunk of dead frag_list code that has
obviously never ever been run since it ends up generating a bogus
GSO-segmented packet with a frag_list entry.

Future work is planned to split super big packets into TSO
ones.

Fixes: 8a29111c7ca6 ("net: gro: allow to build full sized skb")
Reported-by: Christoph Paasch 
Reported-by: Jerry Chu 
Reported-by: Sander Eikelenboom 
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Dumazet 
Tested-by: Sander Eikelenboom 
Tested-by: Eric Dumazet 
Signed-off-by: David S. Miller

netfilter: push reasm skb through instead of original frag skbs

2013-11-11T05:19:35+00:00

Pushing original fragments through causes several problems. For example
for matching, frags may not be matched correctly. Take following
example:


On HOSTA do:
ip6tables -I INPUT -p icmpv6 -j DROP
ip6tables -I INPUT -p icmpv6 -m icmp6 --icmpv6-type 128 -j ACCEPT

and on HOSTB you do:
ping6 HOSTA -s2000    (MTU is 1500)

Incoming echo requests will be filtered out on HOSTA. This issue does
not occur with smaller packets than MTU (where fragmentation does not happen)


As was discussed previously, the only correct solution seems to be to use
reassembled skb instead of separete frags. Doing this has positive side
effects in reducing sk_buff by one pointer (nfct_reasm) and also the reams
dances in ipvs and conntrack can be removed.

Future plan is to remove net/ipv6/netfilter/nf_conntrack_reasm.c
entirely and use code in net/ipv6/reassembly.c instead.

Signed-off-by: Jiri Pirko 
Acked-by: Julian Anastasov 
Signed-off-by: Marcelo Ricardo Leitner 
Signed-off-by: David S. Miller