From: Soheil Hassas Yeganeh <soheil.k...@gmail.com>
Date: Sat, 18 Mar 2017 17:02:59 -0400
> From: Soheil Hassas Yeganeh <soh...@google.com>
>
> __sock_recv_timestamp can be called for both normal skbs (for
> receive timestamps) and for skbs on the error queue (for transmit
> timestamps).
>
> Commit 1c885808e456
> (tcp: SOF_TIMESTAMPING_OPT_STATS option for SO_TIMESTAMPING)
> assumes any skb passed to __sock_recv_timestamp are from
> the error queue, containing OPT_STATS in the content of the skb.
> This results in accessing invalid memory or generating junk
> data.
>
> To fix this, set skb->pkt_type to PACKET_OUTGOING for packets
> on the error queue. This is safe because on the receive path
> on local sockets skb->pkt_type is never set to PACKET_OUTGOING.
> With that, copy OPT_STATS from a packet, only if its pkt_type
> is PACKET_OUTGOING.
>
> Fixes: 1c885808e456 ("tcp: SOF_TIMESTAMPING_OPT_STATS option for
> SO_TIMESTAMPING")
> Reported-by: JongHwan Kim <zzoru...@gmail.com>
> Signed-off-by: Soheil Hassas Yeganeh <soh...@google.com>
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Signed-off-by: Willem de Bruijn <will...@google.com>
Applied and queued up for -stable.
