net: orphan frags on receive

mstsirkin · davem330 · commit 1080e512d44d · 2012-07-22T12:39:33.000-07:00
zero copy packets are normally sent to the outside
network, but bridging, tun etc might loop them
back to host networking stack. If this happens
destructors will never be called, so orphan
the frags immediately on receive.

Signed-off-by: Michael S. Tsirkin &lt;mst@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -1632,6 +1632,8 @@ static inline int deliver_skb(struct sk_buff *skb,
 			      struct packet_type *pt_prev,
 			      struct net_device *orig_dev)
 {
+	if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
+		return -ENOMEM;
 	atomic_inc(&skb->users);
 	return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
 }
@@ -3262,7 +3264,10 @@ static int __netif_receive_skb(struct sk_buff *skb)
 	}
 
 	if (pt_prev) {
-		ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+		if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
+			ret = -ENOMEM;
+		else
+			ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
 	} else {
 		atomic_long_inc(&skb->dev->rx_dropped);
 		kfree_skb(skb);

Original file line number	Diff line number	Diff line change
`@@ -1632,6 +1632,8 @@ static inline int deliver_skb(struct sk_buff *skb,`
`1632`	`1632`	`struct packet_type *pt_prev,`
`1633`	`1633`	`struct net_device *orig_dev)`
`1634`	`1634`	`{`
	`1635`	`+ if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))`
	`1636`	`+ return -ENOMEM;`
`1635`	`1637`	`atomic_inc(&skb->users);`
`1636`	`1638`	`return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);`
`1637`	`1639`	`}`
`@@ -3262,7 +3264,10 @@ static int __netif_receive_skb(struct sk_buff *skb)`
`3262`	`3264`	`}`
`3263`	`3265`
`3264`	`3266`	`if (pt_prev) {`
`3265`		`- ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);`
	`3267`	`+ if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))`
	`3268`	`+ ret = -ENOMEM;`
	`3269`	`+ else`
	`3270`	`+ ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);`
`3266`	`3271`	`} else {`
`3267`	`3272`	`atomic_long_inc(&skb->dev->rx_dropped);`
`3268`	`3273`	`kfree_skb(skb);`