Commit 9913ff9c authored by Eric Dumazet's avatar Eric Dumazet Committed by Luis Henriques

net: add pfmemalloc check in sk_add_backlog()

commit c7c49b8f upstream.

Greg reported crashes hitting the following check in __sk_backlog_rcv()

	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));

The pfmemalloc bit is currently checked in sk_filter().

This works correctly for TCP, because sk_filter() is ran in
tcp_v[46]_rcv() before hitting the prequeue or backlog checks.

For UDP or other protocols, this does not work, because the sk_filter()
is ran from sock_queue_rcv_skb(), which might be called _after_ backlog
queuing if socket is owned by user by the time packet is processed by
softirq handler.

Fixes: b4b9e355 ("netvm: set PF_MEMALLOC as appropriate during SKB processing")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarGreg Thelen <gthelen@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent fc3befaa
...@@ -807,6 +807,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s ...@@ -807,6 +807,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s
if (sk_rcvqueues_full(sk, skb, limit)) if (sk_rcvqueues_full(sk, skb, limit))
return -ENOBUFS; return -ENOBUFS;
/*
* If the skb was allocated from pfmemalloc reserves, only
* allow SOCK_MEMALLOC sockets to use it as this socket is
* helping free memory
*/
if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC))
return -ENOMEM;
__sk_add_backlog(sk, skb); __sk_add_backlog(sk, skb);
sk->sk_backlog.len += skb->truesize; sk->sk_backlog.len += skb->truesize;
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment