Merge branch 'dst-tag-ksz-fix'

Florian Fainelli says:

====================
net: dsa: Fix tag_ksz.c

This implements David's suggestion of providing low-level functions
to control whether skb_pad() and skb_put_padto() should be freeing
the passed skb.

We make use of it to fix a double free in net/dsa/tag_ksz.c that would
occur if we kept using skb_put_padto() in both places.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index dbe29b6c9bd6097b4a7e5763ad39d26921780270..d67a8182e5eb2177d978ca8a5effeaf6bd579394 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -973,7 +973,23 @@ int __must_check skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg
 int __must_check skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg,
                              int offset, int len);
 int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer);
-int skb_pad(struct sk_buff *skb, int pad);
+int __skb_pad(struct sk_buff *skb, int pad, bool free_on_error);
+
+/**
+ *     skb_pad                 -       zero pad the tail of an skb
+ *     @skb: buffer to pad
+ *     @pad: space to pad
+ *
+ *     Ensure that a buffer is followed by a padding area that is zero
+ *     filled. Used by network drivers which may DMA or transfer data
+ *     beyond the buffer end onto the wire.
+ *
+ *     May return error in out of memory cases. The skb is freed on error.
+ */
+static inline int skb_pad(struct sk_buff *skb, int pad)
+{
+       return __skb_pad(skb, pad, true);
+}
 #define dev_kfree_skb(a)       consume_skb(a)
 
 int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
@@ -2825,25 +2841,42 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len)
  *     skb_put_padto - increase size and pad an skbuff up to a minimal size
  *     @skb: buffer to pad
  *     @len: minimal length
+ *     @free_on_error: free buffer on error
  *
  *     Pads up a buffer to ensure the trailing bytes exist and are
  *     blanked. If the buffer already contains sufficient data it
  *     is untouched. Otherwise it is extended. Returns zero on
- *     success. The skb is freed on error.
+ *     success. The skb is freed on error if @free_on_error is true.
  */
-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
+static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
+                                 bool free_on_error)
 {
        unsigned int size = skb->len;
 
        if (unlikely(size < len)) {
                len -= size;
-               if (skb_pad(skb, len))
+               if (__skb_pad(skb, len, free_on_error))
                        return -ENOMEM;
                __skb_put(skb, len);
        }
        return 0;
 }
 
+/**
+ *     skb_put_padto - increase size and pad an skbuff up to a minimal size
+ *     @skb: buffer to pad
+ *     @len: minimal length
+ *
+ *     Pads up a buffer to ensure the trailing bytes exist and are
+ *     blanked. If the buffer already contains sufficient data it
+ *     is untouched. Otherwise it is extended. Returns zero on
+ *     success. The skb is freed on error.
+ */
+static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
+{
+       return __skb_put_padto(skb, len, true);
+}
+
 static inline int skb_add_data(struct sk_buff *skb,
                               struct iov_iter *from, int copy)
 {

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f990eb8b30a9c4a57ef39d34413dd2f2a75babb6..e0755660628407e5a1cefc9ed2c4a725f68628a0 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1363,18 +1363,20 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
 EXPORT_SYMBOL(skb_copy_expand);
 
 /**
- *     skb_pad                 -       zero pad the tail of an skb
+ *     __skb_pad               -       zero pad the tail of an skb
  *     @skb: buffer to pad
  *     @pad: space to pad
+ *     @free_on_error: free buffer on error
  *
  *     Ensure that a buffer is followed by a padding area that is zero
  *     filled. Used by network drivers which may DMA or transfer data
  *     beyond the buffer end onto the wire.
  *
- *     May return error in out of memory cases. The skb is freed on error.
+ *     May return error in out of memory cases. The skb is freed on error
+ *     if @free_on_error is true.
  */
 
-int skb_pad(struct sk_buff *skb, int pad)
+int __skb_pad(struct sk_buff *skb, int pad, bool free_on_error)
 {
        int err;
        int ntail;
@@ -1403,10 +1405,11 @@ int skb_pad(struct sk_buff *skb, int pad)
        return 0;
 
 free_skb:
-       kfree_skb(skb);
+       if (free_on_error)
+               kfree_skb(skb);
        return err;
 }
-EXPORT_SYMBOL(skb_pad);
+EXPORT_SYMBOL(__skb_pad);
 
 /**
  *     pskb_put - add data to the tail of a potentially fragmented buffer

diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index de66ca8e620177693e55b54492404d8d3ee52197..3bd6e2a83125ed4751067fa13c8476bf5e39fc35 100644 (file)
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -42,7 +42,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
        padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
 
        if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
-               if (skb_put_padto(skb, skb->len + padlen))
+               /* Let dsa_slave_xmit() free skb */
+               if (__skb_put_padto(skb, skb->len + padlen, false))
                        return NULL;
 
                nskb = skb;
@@ -60,10 +61,11 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
                                         skb_transport_header(skb) - skb->head);
                skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
 
-               if (skb_put_padto(nskb, nskb->len + padlen)) {
-                       kfree_skb(nskb);
+               /* Let skb_put_padto() free nskb, and let dsa_slave_xmit() free
+                * skb
+                */
+               if (skb_put_padto(nskb, nskb->len + padlen))
                        return NULL;
-               }
 
                kfree_skb(skb);
        }