This is a note to let you know that I've just added the patch titled
net: fix a race in sock_queue_err_skb()
to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-fix-a-race-in-sock_queue_err_skb.patch
and it can be found in the queue-3.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From f1481a5355ab4b9f68ab8c98816ede4d42967f81 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <[email protected]>
Date: Fri, 6 Apr 2012 10:49:10 +0200
Subject: net: fix a race in sock_queue_err_skb()
From: Eric Dumazet <[email protected]>
[ Upstream commit 110c43304db6f06490961529536c362d9ac5732f ]
As soon as an skb is queued into socket error queue, another thread
can consume it, so we are not allowed to reference skb anymore, or risk
use after free.
Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/core/skbuff.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2985,6 +2985,8 @@ static void sock_rmem_free(struct sk_buf
*/
int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
{
+ int len = skb->len;
+
if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
(unsigned)sk->sk_rcvbuf)
return -ENOMEM;
@@ -2999,7 +3001,7 @@ int sock_queue_err_skb(struct sock *sk,
skb_queue_tail(&sk->sk_error_queue, skb);
if (!sock_flag(sk, SOCK_DEAD))
- sk->sk_data_ready(sk, skb->len);
+ sk->sk_data_ready(sk, len);
return 0;
}
EXPORT_SYMBOL(sock_queue_err_skb);
Patches currently in stable-queue which might be from [email protected] are
queue-3.0/net-fix-a-race-in-sock_queue_err_skb.patch
queue-3.0/tcp-allow-splice-to-build-full-tso-packets.patch
queue-3.0/net-smsc911x-fix-skb-handling-in-receive-path.patch
queue-3.0/netlink-fix-races-after-skb-queueing.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
