From: David Miller <davem@davemloft.net>
To: mst@redhat.com
Cc: linux-kernel@vger.kernel.org, jbenc@redhat.com, netdev@vger.kernel.org
Subject: Re: [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs
Date: Tue, 11 Mar 2014 16:27:14 -0400 (EDT) [thread overview]
Message-ID: <20140311.162714.1118698288267206477.davem@davemloft.net> (raw)
In-Reply-To: <1394468807-25980-1-git-send-email-mst@redhat.com>
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Mon, 10 Mar 2014 18:29:01 +0200
> This fixes a bug in skb_segment where it moves frags
> between skbs without orphaning them.
> This causes userspace to assume it's safe to
> reuse the buffer, and receiver gets corrupted data.
> This further might leak information from the
> transmitter on the wire.
>
> To fix track which skb does a copied frag belong
> to, and orphan frags when copying them.
>
> As we are tracking multiple skbs here, using
> short names (skb,nskb,fskb,skb_frag,frag) becomes confusing.
> So before adding another one, I refactor these names
> slightly.
>
> Patch is split out to make it easier to
> verify that all trasformations are trivially correct.
>
> The problem was observed in the field,
> so I think that the patch is necessary on stable
> as well.
Series applied and queued up for -stable, thanks for fixing this.
prev parent reply other threads:[~2014-03-11 20:27 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-10 16:29 Michael S. Tsirkin
2014-03-10 16:29 ` [PATCH 1/5] skbuff: skb_segment: s/frag/nskb_frag/ Michael S. Tsirkin
2014-03-10 16:29 ` [PATCH 2/5] skbuff: skb_segment: s/skb_frag/frag/ Michael S. Tsirkin
2014-03-10 16:29 ` [PATCH 3/5] skbuff: skb_segment: s/skb/head_skb/ Michael S. Tsirkin
2014-03-10 17:27 ` [PATCH 4/5] skbuff: skb_segment: s/fskb/list_skb/ Michael S. Tsirkin
2014-03-10 17:40 ` David Miller
2014-03-10 17:43 ` David Miller
2014-03-10 17:56 ` Michael S. Tsirkin
2014-03-10 20:45 ` David Miller
2014-03-10 17:28 ` [PATCH 5/5] skbuff: skb_segment: orphan frags before copying Michael S. Tsirkin
2014-03-10 21:34 ` Herbert Xu
2014-03-10 21:52 ` Michael S. Tsirkin
2014-03-10 21:56 ` Herbert Xu
2014-03-10 22:07 ` Michael S. Tsirkin
2014-03-10 22:12 ` Herbert Xu
2014-03-10 22:30 ` Michael S. Tsirkin
2014-03-11 0:39 ` Herbert Xu
2014-03-11 6:41 ` Michael S. Tsirkin
2014-03-11 7:21 ` Herbert Xu
2014-03-11 20:27 ` David Miller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140311.162714.1118698288267206477.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=jbenc@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®