Re: [PATCH net] tcp: add sanity checks to rx zerocopy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jan 25, 2024 at 10:33:17AM +0000, Eric Dumazet wrote:
> +++ b/net/ipv4/tcp.c
> @@ -1786,7 +1786,17 @@ static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb,
>  
>  static bool can_map_frag(const skb_frag_t *frag)
>  {
> -	return skb_frag_size(frag) == PAGE_SIZE && !skb_frag_off(frag);
> +	struct page *page;
> +
> +	if (skb_frag_size(frag) != PAGE_SIZE || skb_frag_off(frag))
> +		return false;
> +
> +	page = skb_frag_page(frag);
> +
> +	if (PageCompound(page) || page->mapping)
> +		return false;

I'm not entirely sure why you're testing PageCompound here.  If a driver
allocates a compound page, we'd still want to be able to insert it,
right?

I have a feeling that we want to fix this in the VM layer.  There are
some weird places calling vm_insert_page() and we should probably make
them all fail.

Something like this, perhaps?

diff --git a/mm/memory.c b/mm/memory.c
index 1a60faad2e49..ae0abab56d38 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1871,6 +1871,10 @@ static int insert_page_into_pte_locked(struct vm_area_struct *vma, pte_t *pte,
 
 	if (!pte_none(ptep_get(pte)))
 		return -EBUSY;
+	if (folio->mapping &&
+	    ((addr - vma->vm_start) / PAGE_SIZE + vma->vm_pgoff) !=
+	    (folio->index + folio_page_idx(folio, page)))
+		return -EINVAL;
 	/* Ok, finally just insert the thing.. */
 	folio_get(folio);
 	inc_mm_counter(vma->vm_mm, mm_counter_file(folio));




[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [NTFS 3]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [NTFS 3]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux