> syzbot and other bots reported that we have to enable
> user copy to/from skb->head. [1]
>
> We can prevent access to skb_shared_info, which is a nice
> improvement over standard kmem_cache.
>
> Layout of these kmem_cache objects is:
>
> < SKB_SMALL_HEAD_HEADROOM >< struct skb_shared_info >
>
> usercopy: Kernel memory overwrite attempt detected to SLUB object 'skbuff_small_head' (offset 32, size 20)!
> ------------[ cut here ]------------
> kernel BUG at mm/usercopy.c:102 !
[...]
LKFT also reported this problem on today's Linux next-20230209.
Link: https://lore.kernel.org/linux-next/CA+G9fYs-i-c2KTSA7Ai4ES_ZESY1ZnM=Zuo8P1j…
Reported-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
>
> Fixes: bf9f1baa279f ("net: add dedicated kmem_cache for typical/small skb->head")
> Reported-by: syzbot <syzkaller(a)googlegroups.com>
> Signed-off-by: Eric Dumazet <edumazet(a)google.com>
Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org>
Thanks for providing a quick fix.
--
Linaro LKFT
https://lkft.linaro.org
Total jobs: 54
Total errors: 13 (24.07%)
LAVA errors: 0 (0.00%)
Test errors: 8 (14.81%)
Job errors: 0 (0.00%)
Infra errors: 5 (9.26%)
Canceled jobs: 0 (0.00%)
Device type: hi6220-hikey-r2
Total jobs: 7
Total errors: 3 (42.86%)
Error type: Test
Error count: 3 (42.86%)
Error: No match for error type 'Test', message 'tradefed - adb device lost[311A0E78003D2FFF]'
Count: 1 (14.29%)
IDs:
hikey-6220-r2-09:
6144179
Error: No match for error type 'Test', message 'tradefed - adb device lost[6EDCB009004013EF]'
Count: 1 (14.29%)
IDs:
hikey-6220-r2-08:
6144142
Error: No match for error type 'Test', message 'tradefed - adb device lost[8D6E5F00030E051]'
Count: 1 (14.29%)
IDs:
hikey-6220-r2-02:
6143960
Device type: x15
Total jobs: 3
Total errors: 1 (33.33%)
Error type: Test
Error count: 1 (33.33%)
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 21585 seconds'
Count: 1 (33.33%)
IDs:
x15-04:
6143747
Device type: dragonboard-845c
Total jobs: 44
Total errors: 9 (20.45%)
Error type: Test
Error count: 4 (9.09%)
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 586 seconds'
Count: 2 (4.55%)
IDs:
db845c-02:
6130508 6143198
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 28785 seconds'
Count: 1 (2.27%)
IDs:
db845c-08:
6115709
Error: No match for error type 'Test', message 'lava-docker-test-shell timed out after 53986 seconds'
Count: 1 (2.27%)
IDs:
db845c-03:
6115707
Error type: Infrastructure
Error count: 5 (11.36%)
Error: Connection closed
Count: 5 (11.36%)
IDs:
db845c-02:
6143195
db845c-03:
6143196
db845c-09:
6131021 6143166
db845c-10:
6143184