• Chris Leech's avatar
    [SCSI] libfc, fcoe: fixes for highmem skb linearize panics · 18fa11ef
    Chris Leech authored
    There are cases outside of our control that may result in a transmit
    skb being linearized in dev_queue_xmit.  There are a couple of bugs
    in libfc/fcoe that can result in a panic at that point.  This patch
    contains two fixes to prevent those panics.
    
    1) use fast cloning instead of shared skbs with dev_queue_xmit
    
    dev_queue_xmit doen't want shared skbuffs being passed in, and
    __skb_linearize will BUG if the skb is shared.  FCoE is holding an extra
    reference around the call to dev_queue_xmit, so that when it returns an
    error code indicating the frame has been dropped it can maintain it's
    own backlog and retransmit.  Switch to using fast skb cloning for this
    instead.
    
    2) don't append compound pages as > PAGE_SIZE skb fragments
    
    fc_fcp_send_data will append pages from a scatterlist to the nr_frags[]
    if the netdev supports it.  But, it's using > PAGE_SIZE compound pages
    as a single skb_frag.  In the highmem linearize case that page will be
    passed to kmap_atomic to get a mapping to copy out of, but
    kmap_atomic will only allow access to the first PAGE_SIZE part.
    The memcpy will keep going and cause a page fault once is crosses the
    first boundary.
    
    If fc_fcp_send_data uses linear buffers from the start, it calls
    kmap_atomic one PAGE_SIZE at a time.  That same logic needs to be
    applied when setting up skb_frags.
    Signed-off-by: default avatarChris Leech <christopher.leech@intel.com>
    Signed-off-by: default avatarRobert Love <robert.w.love@intel.com>
    Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
    18fa11ef
fc_fcp.c 57.5 KB