net: orphan frags on receive

zero copy packets are normally sent to the outside
network, but bridging, tun etc might loop them
back to host networking stack. If this happens
destructors will never be called, so orphan
the frags immediately on receive.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/core/dev.c b/net/core/dev.c
index d70e4a3a49f2f86f41dd9410845147963c5d011b..cca02ae7a844ffa5d9bb3897dd1e2998a41ca653 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1632,6 +1632,8 @@ static inline int deliver_skb(struct sk_buff *skb,
                              struct packet_type *pt_prev,
                              struct net_device *orig_dev)
 {
+       if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
+               return -ENOMEM;
        atomic_inc(&skb->users);
        return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
 }
@@ -3262,7 +3264,10 @@ ncls:
        }
 
        if (pt_prev) {
-               ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+               if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
+                       ret = -ENOMEM;
+               else
+                       ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
        } else {
                atomic_long_inc(&skb->dev->rx_dropped);
                kfree_skb(skb);