From 0daa9b15d32d37357fdff123929e5fd630fb02e5 Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Fri, 15 May 2020 17:56:12 -0600 Subject: [PATCH] core: Check for aggregated skb size before copy This ensures that the target aggregated skb has sufficient tailroom to copy the incoming skb content. Checking for the configured size may not reflect the true value. Fixes the following- <2> skbuff: skb_over_panic: text:000000006faa6b25 len:4044 put:1288 head:000000007024fb17 data:000000007024fb17 tail:0xfcc end:0xec0 dev:rmnet_ipa0 <2> ------------[ cut here ]------------ <2> kernel ... at net/core/skbuff.c:108! <2> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP <2> pc : skb_panic+0x4c/0x50 <2> lr : skb_panic+0x4c/0x50 <2> Call trace: <2> skb_panic+0x4c/0x50 <2> skb_push+0x0/0x44 <2> skb_copy_bits+0x0/0x264 <2> rmnet_map_linearize_copy+0xa8/0x110 [rmnet_core] <2> rmnet_map_tx_aggregate+0x358/0x45c [rmnet_core] <2> rmnet_egress_handler+0x2cc/0x2f4 [rmnet_core] <2> rmnet_vnd_start_xmit+0x1a0/0x1f8 [rmnet_core] <2> dev_hard_start_xmit+0x1e0/0x394 <2> sch_direct_xmit+0xe4/0x32c <2> __qdisc_run+0x4ec/0xb48 <2> __dev_queue_xmit.llvm.8867084656021901384+0x3ec/0x9c8 <2> neigh_direct_output+0x18/0x24 <2> ip_finish_output2+0x3f4/0x5b0 <2> __ip_finish_output+0x1d4/0x248 <2> ip_finish_output+0x50/0xe0 <2> ip_output+0x148/0x194 <2> __ip_queue_xmit+0x378/0x3d4 <2> ip_queue_xmit+0x14/0x20 <2> __tcp_transmit_skb+0x7b4/0xc4c <2> tcp_write_xmit+0x868/0x1194 <2> __tcp_push_pending_frames+0x38/0xd0 <2> tcp_push+0x124/0x154 <2> tcp_sendmsg_locked+0xae4/0xcd0 <2> tcp_sendmsg+0x38/0x5c <2> inet6_sendmsg+0x5c/0xa4 <2> sock_write_iter+0xf8/0x17c <2> __vfs_write+0x1a0/0x220 <2> vfs_write+0xe4/0x1a8 <2> ksys_write+0x7c/0xe8 <2> __arm64_sys_write+0x1c/0x28 <2> el0_svc_common+0xb8/0x1c4 <2> el0_svc_handler+0x6c/0x88 <2> el0_svc+0x8/0xc CRs-Fixed: 2687877 Change-Id: If8cf289c2629be28b890927c54cb4d4209b24bc5 Signed-off-by: Subash Abhinov Kasiviswanathan --- core/rmnet_map_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/rmnet_map_data.c b/core/rmnet_map_data.c index 58244722c5a0..29d7927854cf 100644 --- a/core/rmnet_map_data.c +++ b/core/rmnet_map_data.c @@ -1485,7 +1485,7 @@ new_packet: goto schedule; } diff = timespec64_sub(port->agg_last, port->agg_time); - size = port->egress_agg_params.agg_size - port->agg_skb->len; + size = skb_tailroom(port->agg_skb); if (skb->len > size || port->agg_count >= port->egress_agg_params.agg_count ||