A received sk buffer may contain dozens of smaller 'bundled' messages
which after extraction go each in their own direction.

Unfortunately, when we extract those messages using skb_clone() each
of the extracted buffers inherit the truesize value of the original
buffer. Apart from causing massive overaccounting of the base buffer's
memory, this often causes tipc_msg_validate() to come to the false
conclusion that the ratio truesize/datasize > 4, and perform an
unnecessary copying of the extracted buffer.

We now fix this problem by explicitly correcting the truesize value of
the buffer clones to be the truesize of the clone itself. This change
eliminates both the overaccounting and the unnecessary buffer copying.

Reported-by: Hoang Le <hoang.h...@dektek.com.au>
Acked-by: Ying Xue <ying....@windriver.com>
Signed-off-by: Jon Maloy <jon.ma...@ericsson.com>
 net/tipc/msg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 4e1c6f6..a368fa8 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -434,6 +434,9 @@ bool tipc_msg_extract(struct sk_buff *skb, struct sk_buff 
**iskb, int *pos)
        skb_pull(*iskb, offset);
        imsz = msg_size(buf_msg(*iskb));
        skb_trim(*iskb, imsz);
+       /* Scale extracted buffer's truesize to avoid double accounting */
+       (*iskb)->truesize = SKB_TRUESIZE(imsz);
        if (unlikely(!tipc_msg_validate(iskb)))
                goto none;
        *pos += align(imsz);

Reply via email to