diff options
| author | Eric Dumazet <edumazet@google.com> | 2015-09-29 18:52:25 -0700 |
|---|---|---|
| committer | Luis Henriques <luis.henriques@canonical.com> | 2015-10-28 10:33:19 +0000 |
| commit | 9913ff9cdc4eec7d7659eb2090348d1ba02d6bd9 (patch) | |
| tree | bf00126a7e356b1b42ba650912730b2030706c7c | |
| parent | fc3befaacb2c900d239c65562f253b95344448b0 (diff) | |
net: add pfmemalloc check in sk_add_backlog()
commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b upstream.
Greg reported crashes hitting the following check in __sk_backlog_rcv()
BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));
The pfmemalloc bit is currently checked in sk_filter().
This works correctly for TCP, because sk_filter() is ran in
tcp_v[46]_rcv() before hitting the prequeue or backlog checks.
For UDP or other protocols, this does not work, because the sk_filter()
is ran from sock_queue_rcv_skb(), which might be called _after_ backlog
queuing if socket is owned by user by the time packet is processed by
softirq handler.
Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
| -rw-r--r-- | include/net/sock.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index 927cfc56b76a..9c24377a7bc9 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -807,6 +807,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s if (sk_rcvqueues_full(sk, skb, limit)) return -ENOBUFS; + /* + * If the skb was allocated from pfmemalloc reserves, only + * allow SOCK_MEMALLOC sockets to use it as this socket is + * helping free memory + */ + if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) + return -ENOMEM; + __sk_add_backlog(sk, skb); sk->sk_backlog.len += skb->truesize; return 0; |