diff options
| author | Florian Westphal <[email protected]> | 2020-03-30 18:51:29 +0200 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2020-03-30 10:41:58 -0700 |
| commit | cf673ed0e057a2dd68d930c6d7e30d53c70c5789 (patch) | |
| tree | e34bc055bc67c8fe53789f50b6b17ff1004b02ee /tools/perf/scripts/python/export-to-sqlite.py | |
| parent | bde1b56f898ca8112912d7b36e55e1543b3be0cf (diff) | |
net: fix fraglist segmentation reference count leak
Xin Long says:
On udp rx path udp_rcv_segment() may do segment where the frag skbs
will get the header copied from the head skb in skb_segment_list()
by calling __copy_skb_header(), which could overwrite the frag skbs'
extensions by __skb_ext_copy() and cause a leak.
This issue was found after loading esp_offload where a sec path ext
is set in the skb.
Fix this by discarding head state of the fraglist skb before replacing
its contents.
Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
Cc: Steffen Klassert <[email protected]>
Reported-by: Xiumei Mu <[email protected]>
Tested-by: Xin Long <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Acked-by: Steffen Klassert <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/export-to-sqlite.py')
0 files changed, 0 insertions, 0 deletions