diff options
| author | Eric Dumazet <edumazet@google.com> | 2023-04-28 04:32:31 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-04-28 09:40:38 +0100 |
| commit | 7e692df3933628d974acb9f5b334d2b3e885e2a6 (patch) | |
| tree | d1035e03aa85a1181ee43d4f1576581c4fb1e323 /net/mctp | |
| parent | 6f75cd166a5a3c0bc50441faa8b8304f60522fdd (diff) | |
tcp: fix skb_copy_ubufs() vs BIG TCP
David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy
using hugepages, and skb length bigger than ~68 KB.
skb_copy_ubufs() assumed it could copy all payload using up to
MAX_SKB_FRAGS order-0 pages.
This assumption broke when BIG TCP was able to put up to 512 KB per skb.
We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45
and limit gso_max_size to 180000.
A solution is to use higher order pages if needed.
v2: add missing __GFP_COMP, or we leak memory.
Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
Reported-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/netdev/c70000f6-baa4-4a05-46d0-4b3e0dc1ccc8@gmail.com/T/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Xin Long <lucien.xin@gmail.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Coco Li <lixiaoyan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mctp')
0 files changed, 0 insertions, 0 deletions