search for: skb_set_owner_w

...rtio_transport_init_hdr(skb, info, src_cid, src_port, > + dst_cid, dst_port, > + payload_len); > + > + /* Set owner here, because '__zerocopy_sg_from_iter()' uses > + * owner of skb without check to update 'sk_wmem_alloc'. > + */ > + if (vsk) > + skb_set_owner_w(skb, sk_vsock(vsk)); ... which can lead to bad things(TM) if the skb goes trough some later non trivial processing, due to the above skb_set_owner_w(). Additionally can be the following condition be true: vsk == NULL && (info->msg && payload_len > 0) && zcopy ???...

...cid, dst_port, > > > + payload_len); > > > + > > > + /* Set owner here, because '__zerocopy_sg_from_iter()' uses > > > + * owner of skb without check to update 'sk_wmem_alloc'. > > > + */ > > > + if (vsk) > > > + skb_set_owner_w(skb, sk_vsock(vsk)); > > > > ... which can lead to bad things(TM) if the skb goes trough some later > > non trivial processing, due to the above skb_set_owner_w(). > > > > Additionally can be the following condition be true: > > > > vsk == NULL &&am...

...d and filled with the pages of user's buffer. Pages of user's >>> buffer are locked in memory by 'get_user_pages()'. Second thing that >>> this patch does is replace type of skb owning: instead of calling >>> 'skb_set_owner_sk_safe()' it calls 'skb_set_owner_w()'. Reason of this >>> change is that '__zerocopy_sg_from_iter()' increments 'sk_wmem_alloc' >>> of socket, so to decrease this field correctly proper skb destructor is >>> needed: 'sock_wfree()'. This destructor is set by 'skb_set_owner_w(...

...ybe it's: > > tap_sendmsg() > tap_get_user_xdp() > build_skb() > skb_probe_transport_header() > skb_flow_dissect_flow_keys_basic() > __skb_flow_dissect() Oh, indeed. I completely overlooked that path. I will call skb_set_owner_w there and will audit the other users of build_skb.

...nsport_common.c index 957cdc01c8e8..d47ad27b409d 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -236,6 +236,7 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk, } virtio_transport_inc_tx_pkt(vvs, skb); + skb_set_owner_w(skb, sk_vsock(vsk)); return t_ops->send_pkt(skb); }

Hi, Back in October I reported that I noticed a problem whereby flow control breaks down when openvswitch is configured to mirror a port[1]. I have (finally) looked into this further and the problem appears to relate to cloning of skbs, as Jesse Gross originally suspected. More specifically, in do_execute_actions[2] the first n-1 times that an skb needs to be transmitted it is cloned first and

Hi, Back in October I reported that I noticed a problem whereby flow control breaks down when openvswitch is configured to mirror a port[1]. I have (finally) looked into this further and the problem appears to relate to cloning of skbs, as Jesse Gross originally suspected. More specifically, in do_execute_actions[2] the first n-1 times that an skb needs to be transmitted it is cloned first and