sock: fix zerocopy panic in mem accounting
authorWillem de Bruijn <willemb@google.com>
Wed, 9 Aug 2017 23:09:43 +0000 (19:09 -0400)
committerDavid S. Miller <davem@davemloft.net>
Wed, 9 Aug 2017 23:49:17 +0000 (16:49 -0700)
commitccaffff182027078e9443d912b5af461850965f4
tree57ab395865cde825c912a20d91cb021beefca6b5
parentd5e7f827a6a20ca0c3545591dae7d24b2ccf1e70
sock: fix zerocopy panic in mem accounting

Only call mm_unaccount_pinned_pages when releasing a struct ubuf_info
that has initialized its field uarg->mmp.

Before this patch, a vhost-net with experimental_zcopytx can crash in

  mm_unaccount_pinned_pages
  sock_zerocopy_put
  skb_zcopy_clear
  skb_release_data

Only sock_zerocopy_alloc initializes this field. Move the unaccount
call from generic sock_zerocopy_put to its specific callback
sock_zerocopy_callback.

Fixes: a91dbff551a6 ("sock: ulimit on MSG_ZEROCOPY pages")
Reported-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/skbuff.c