From: Willem de Bruijn Date: Wed, 9 Aug 2017 23:09:43 +0000 (-0400) Subject: sock: fix zerocopy panic in mem accounting X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=ccaffff182027078e9443d912b5af461850965f4;p=openwrt%2Fstaging%2Fblogic.git sock: fix zerocopy panic in mem accounting Only call mm_unaccount_pinned_pages when releasing a struct ubuf_info that has initialized its field uarg->mmp. Before this patch, a vhost-net with experimental_zcopytx can crash in mm_unaccount_pinned_pages sock_zerocopy_put skb_zcopy_clear skb_release_data Only sock_zerocopy_alloc initializes this field. Move the unaccount call from generic sock_zerocopy_put to its specific callback sock_zerocopy_callback. Fixes: a91dbff551a6 ("sock: ulimit on MSG_ZEROCOPY pages") Reported-by: David Ahern Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller --- diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 42b62c716a33..cb123590c674 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1044,6 +1044,8 @@ void sock_zerocopy_callback(struct ubuf_info *uarg, bool success) u32 lo, hi; u16 len; + mm_unaccount_pinned_pages(&uarg->mmp); + /* if !len, there was only 1 call, and it was aborted * so do not queue a completion notification */ @@ -1084,8 +1086,6 @@ EXPORT_SYMBOL_GPL(sock_zerocopy_callback); void sock_zerocopy_put(struct ubuf_info *uarg) { if (uarg && atomic_dec_and_test(&uarg->refcnt)) { - mm_unaccount_pinned_pages(&uarg->mmp); - if (uarg->callback) uarg->callback(uarg, uarg->zerocopy); else