Staging: batman-adv: Keep header writable and unshared

my_skb_push provided an easy way to allocate enough headroom in
situation were we don't have enough space left and move the data pointer
to the new position, but we didn't checked wether we are allowed to
write to the new pushed header. This is for example a problem when the
skb was cloned and thus doesn't have a private data part.

my_skb_head_push now replaces my_skb_push by using skb_cow_head to
provide only a large enough, writable header without testing for the
rest of the (maybe shared) data. It will also move the data pointer
using skb_push when skb_cow_head doesn't fail.

This should give us enough flexibility in situation were skbs will be
queued by underlying layers and still doesn't unnecessarily copy the
data in situations when the skb was consumed right away during
dev_queue_xmit.

Reported-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 14 insertions, 12 deletions

diff --git a/drivers/staging/batman-adv/soft-interface.c b/drivers/staging/batman-adv/soft-interface.c
index d60b1a8..e8be209 100644
--- a/drivers/staging/batman-adv/soft-interface.c
+++ b/drivers/staging/batman-adv/soft-interface.c
@@ -31,8 +31,6 @@
 
 static uint32_t bcast_seqno = 1; /* give own bcast messages seq numbers to avoid
 				  * broadcast storms */
-static int32_t skb_packets;
-static int32_t skb_bad_packets;
 
 unsigned char main_if_addr[ETH_ALEN];
 static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd);
@@ -59,18 +57,22 @@ void set_main_if_addr(uint8_t *addr)
 	memcpy(main_if_addr, addr, ETH_ALEN);
 }
 
-int my_skb_push(struct sk_buff *skb, unsigned int len)
+int my_skb_head_push(struct sk_buff *skb, unsigned int len)
 {
-	int result = 0;
+	int result;
 
-	skb_packets++;
-	if (skb_headroom(skb) < len) {
-		skb_bad_packets++;
-		result = pskb_expand_head(skb, len, 0, GFP_ATOMIC);
+	/**
+	 * TODO: We must check if we can release all references to non-payload
+	 * data using skb_header_release in our skbs to allow skb_cow_header to
+	 * work optimally. This means that those skbs are not allowed to read
+	 * or write any data which is before the current position of skb->data
+	 * after that call and thus allow other skbs with the same data buffer
+	 * to write freely in that area.
+	 */
+	result = skb_cow_head(skb, len);
 
-		if (result < 0)
-			return result;
-	}
+	if (result < 0)
+		return result;
 
 	skb_push(skb, len);
 	return 0;
@@ -140,7 +142,7 @@ int interface_tx(struct sk_buff *skb, struct net_device *dev)
 	/* ethernet packet should be broadcasted */
 	if (is_bcast(ethhdr->h_dest) || is_mcast(ethhdr->h_dest)) {
 
-		if (my_skb_push(skb, sizeof(struct bcast_packet)) < 0)
+		if (my_skb_head_push(skb, sizeof(struct bcast_packet)) < 0)
 			goto dropped;
 
 		bcast_packet = (struct bcast_packet *)skb->data;