diff options
author | Ilya Dryomov <idryomov@gmail.com> | 2018-11-08 17:55:37 +0300 |
---|---|---|
committer | Ilya Dryomov <idryomov@gmail.com> | 2018-11-19 19:59:47 +0300 |
commit | 7e241f647dc7087a0401418a187f3f5b527cc690 (patch) | |
tree | f17767bad9a327b294c0d085ab056e5b55d3e3fb /net/dcb | |
parent | 9ff01193a20d391e8dbce4403dd5ef87c7eaaca6 (diff) | |
download | linux-7e241f647dc7087a0401418a187f3f5b527cc690.tar.xz |
libceph: fall back to sendmsg for slab pages
skb_can_coalesce() allows coalescing neighboring slab objects into
a single frag:
return page == skb_frag_page(frag) &&
off == frag->page_offset + skb_frag_size(frag);
ceph_tcp_sendpage() can be handed slab pages. One example of this is
XFS: it passes down sector sized slab objects for its metadata I/O. If
the kernel client is co-located on the OSD node, the skb may go through
loopback and pop on the receive side with the exact same set of frags.
When tcp_recvmsg() attempts to copy out such a frag, hardened usercopy
complains because the size exceeds the object's allocated size:
usercopy: kernel memory exposure attempt detected from ffff9ba917f20a00 (kmalloc-512) (1024 bytes)
Although skb_can_coalesce() could be taught to return false if the
resulting frag would cross a slab object boundary, we already have
a fallback for non-refcounted pages. Utilize it for slab pages too.
Cc: stable@vger.kernel.org # 4.8+
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'net/dcb')
0 files changed, 0 insertions, 0 deletions