diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2021-05-11 10:35:21 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-05-12 13:48:58 -0700 |
| commit | 098116e7e640ba677d9e345cbee83d253c13d556 (patch) | |
| tree | d442e60d9f155abed803536c17afe7f8a0e9b930 /net/core | |
| parent | 440c3247cba3d9433ac435d371dd7927d68772a7 (diff) | |
| download | linux-098116e7e640ba677d9e345cbee83d253c13d556.tar.bz2 | |
net: really orphan skbs tied to closing sk
If the owing socket is shutting down - e.g. the sock reference
count already dropped to 0 and only sk_wmem_alloc is keeping
the sock alive, skb_orphan_partial() becomes a no-op.
When forwarding packets over veth with GRO enabled, the above
causes refcount errors.
This change addresses the issue with a plain skb_orphan() call
in the critical scenario.
Fixes: 9adc89af724f ("net: let skb_orphan_partial wake-up waiters.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/sock.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/core/sock.c b/net/core/sock.c index c761c4a0b66b..958614ea16ed 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2132,10 +2132,10 @@ void skb_orphan_partial(struct sk_buff *skb) if (skb_is_tcp_pure_ack(skb)) return; - if (can_skb_orphan_partial(skb)) - skb_set_owner_sk_safe(skb, skb->sk); - else - skb_orphan(skb); + if (can_skb_orphan_partial(skb) && skb_set_owner_sk_safe(skb, skb->sk)) + return; + + skb_orphan(skb); } EXPORT_SYMBOL(skb_orphan_partial); |