releases/4.4.133/net-test-tailroom-before-appending-to-linear-skb.patch

   1 From foo@baz Tue May 22 21:07:28 CEST 2018
   2 From: Willem de Bruijn <willemb@google.com>
   3 Date: Thu, 17 May 2018 13:13:29 -0400
   4 Subject: net: test tailroom before appending to linear skb
   5
   6 From: Willem de Bruijn <willemb@google.com>
   7
   8 [ Upstream commit 113f99c3358564a0647d444c2ae34e8b1abfd5b9 ]
   9
  10 Device features may change during transmission. In particular with
  11 corking, a device may toggle scatter-gather in between allocating
  12 and writing to an skb.
  13
  14 Do not unconditionally assume that !NETIF_F_SG at write time implies
  15 that the same held at alloc time and thus the skb has sufficient
  16 tailroom.
  17
  18 This issue predates git history.
  19
  20 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
  21 Reported-by: Eric Dumazet <edumazet@google.com>
  22 Signed-off-by: Willem de Bruijn <willemb@google.com>
  23 Reviewed-by: Eric Dumazet <edumazet@google.com>
  24 Signed-off-by: David S. Miller <davem@davemloft.net>
  25 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26 ---
  27  net/ipv4/ip_output.c  |    3 ++-
  28  net/ipv6/ip6_output.c |    3 ++-
  29  2 files changed, 4 insertions(+), 2 deletions(-)
  30
  31 --- a/net/ipv4/ip_output.c
  32 +++ b/net/ipv4/ip_output.c
  33 @@ -1062,7 +1062,8 @@ alloc_new_skb:
  34                 if (copy > length)
  35                         copy = length;
  36
  37 -               if (!(rt->dst.dev->features&NETIF_F_SG)) {
  38 +               if (!(rt->dst.dev->features&NETIF_F_SG) &&
  39 +                   skb_tailroom(skb) >= copy) {
  40                         unsigned int off;
  41
  42                         off = skb->len;
  43 --- a/net/ipv6/ip6_output.c
  44 +++ b/net/ipv6/ip6_output.c
  45 @@ -1529,7 +1529,8 @@ alloc_new_skb:
  46                 if (copy > length)
  47                         copy = length;
  48
  49 -               if (!(rt->dst.dev->features&NETIF_F_SG)) {
  50 +               if (!(rt->dst.dev->features&NETIF_F_SG) &&
  51 +                   skb_tailroom(skb) >= copy) {
  52                         unsigned int off;
  53
  54                         off = skb->len;