skb_expand_head() adjust skb->truesize incorrectly
authorVasily Averin <vvs@virtuozzo.com>
Fri, 22 Oct 2021 10:28:37 +0000 (13:28 +0300)
committerJakub Kicinski <kuba@kernel.org>
Fri, 22 Oct 2021 19:35:51 +0000 (12:35 -0700)
commit7f678def99d29c520418607509bb19c7fc96a6db
tree00dcfb73445680f1c0d78e803d5feacbc7996d6c
parent7fcb1c950e98e47918e86a5aa7b8fcc283ec6629
skb_expand_head() adjust skb->truesize incorrectly

Christoph Paasch reports [1] about incorrect skb->truesize
after skb_expand_head() call in ip6_xmit.
This may happen because of two reasons:
- skb_set_owner_w() for newly cloned skb is called too early,
before pskb_expand_head() where truesize is adjusted for (!skb-sk) case.
- pskb_expand_head() does not adjust truesize in (skb->sk) case.
In this case sk->sk_wmem_alloc should be adjusted too.

[1] https://lkml.org/lkml/2021/8/20/1082

Fixes: f1260ff15a71 ("skbuff: introduce skb_expand_head()")
Fixes: 2d85a1b31dde ("ipv6: ip6_finish_output2: set sk into newly allocated nskb")
Reported-by: Christoph Paasch <christoph.paasch@gmail.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/644330dd-477e-0462-83bf-9f514c41edd1@virtuozzo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/core/skbuff.c
net/core/sock_destructor.h [new file with mode: 0644]