]> git.baikalelectronics.ru Git - kernel.git/commit
ipv6: tcp: fix race in IPV6_2292PKTOPTIONS
authorEric Dumazet <edumazet@google.com>
Wed, 21 Jan 2015 11:45:42 +0000 (03:45 -0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 26 Jan 2015 08:44:08 +0000 (00:44 -0800)
commitd2ddff8cd9117d86c7f99eaa8e3f1bf3943ddb6c
tree5362ed5e14526d303ba83fc1f596f69fb63933ba
parentc0ad856acaf03268ec4ce05eabda41cc05f30149
ipv6: tcp: fix race in IPV6_2292PKTOPTIONS

IPv6 TCP sockets store in np->pktoptions skbs, and use skb_set_owner_r()
to charge the skb to socket.

It means that destructor must be called while socket is locked.

Therefore, we cannot use skb_get() or atomic_inc(&skb->users)
to protect ourselves : kfree_skb() might race with other users
manipulating sk->sk_forward_alloc

Fix this race by holding socket lock for the duration of
ip6_datagram_recv_ctl()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ipv6_sockglue.c