Re: [PATCH net] macsec: drop skb sk before calling gro_cells_receive

2019-09-26 Thread David Miller
From: Xin Long Date: Mon, 23 Sep 2019 17:02:46 +0800 > Fei Liu reported a crash when doing netperf on a topo of macsec > dev over veth: ... > The issue was caused by skb's true_size changed without its sk's > sk_wmem_alloc increased in tcp/skb_gro_receive(). Later when the > skb is being freed a

[PATCH net] macsec: drop skb sk before calling gro_cells_receive

2019-09-23 Thread Xin Long
Fei Liu reported a crash when doing netperf on a topo of macsec dev over veth: [ 448.919128] refcount_t: underflow; use-after-free. [ 449.090460] Call trace: [ 449.092895] refcount_sub_and_test+0xb4/0xc0 [ 449.097155] tcp_wfree+0x2c/0x150 [ 449.100460] ip_rcv+0x1d4/0x3a8 [ 449