diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-09-22 18:33:03 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-22 18:33:03 -0700 |
| commit | 6836807c5f685f83975e45c77c937eb5e79da31e (patch) | |
| tree | 17445fe262802c4eeb3fb16d4884fff5e57472e7 /tools/perf/scripts/python | |
| parent | 4498467a8af06cfa3d71cb04bd7c4170dec8f449 (diff) | |
| parent | 9518405613863d0bf0700927a21367f5942cf058 (diff) | |
| download | linux-6836807c5f685f83975e45c77c937eb5e79da31e.tar.gz linux-6836807c5f685f83975e45c77c937eb5e79da31e.zip | |
Merge branch 'packet-fix-packet_tx_ring-data-corruption-on-skb_orphan'
Willem de Bruijn says:
====================
packet: fix PACKET_TX_RING data corruption on skb_orphan
When transmitting packets via PACKET_TX_RING, tpacket_snd links user
ring buffer pages as skb frags and releases the slot on skb->destructor
(tpacket_destruct_skb).
skb_orphan() invokes the destructor while the skb is still alive.
This marks the slot as TP_STATUS_AVAILABLE prematurely, allowing
userspace to overwrite the slot and causing data corruption.
This series fixes the issue by switching PACKET_TX_RING to standard
ubuf_info zerocopy completion, ensuring ring slots are released only
after all payload references are freed or copied.
Virtio-net needs a separate solution, because deferring the release
can cause deadlock in its !use_napi mode.
- Patch 1 addresses the virtio-net special case.
- Patch 2 converts tpacket_snd to standard ubuf_info completion
Patch 1 must be applied, and backported, before patch 2. Both carry
the same Fixes tag for that reason.
v1: https://lore.kernel.org/netdev/20260914214229.1674102-1-willemdebruijn.kernel@gmail.com/
====================
Link: https://patch.msgid.link/20260919004748.1463985-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions