From f91d76c86b52582632ca18b45e3bdec298ab0a8e Mon Sep 17 00:00:00 2001 From: Jonathan Lemon Date: Thu, 11 Nov 2021 16:29:07 +0800 Subject: [PATCH] skbuff: Call skb_zcopy_clear() before unref'ing fragments mainline inclusion from mainline-v5.12-rc1-dontuse commit 70c4316749f6 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4CVS3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=70c4316749f6 ---------------------------------------------------------------------- RX zerocopy fragment pages which are not allocated from the system page pool require special handling. Give the callback in skb_zcopy_clear() a chance to process them first. Signed-off-by: Jonathan Lemon Signed-off-by: Jakub Kicinski Reviewed-by: Yongxin Li Signed-off-by: Junxin Chen Signed-off-by: Zheng Zengkai --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 825e6b988003..91661352dca8 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -614,13 +614,14 @@ static void skb_release_data(struct sk_buff *skb) &shinfo->dataref)) return; + skb_zcopy_clear(skb, true); + for (i = 0; i < shinfo->nr_frags; i++) __skb_frag_unref(&shinfo->frags[i]); if (shinfo->frag_list) kfree_skb_list(shinfo->frag_list); - skb_zcopy_clear(skb, true); skb_free_head(skb); } -- GitLab