mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-26 18:43:33 -05:00
Code Activity

netlink: fix races after skb queueing

Browse source 
As soon as an skb is queued into socket receive_queue, another thread
can consume it, so we are not allowed to reference skb anymore, or risk
use after free.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2012-04-05 22:17:46 +00:00 • committed by David S. Miller
parent e34fac1c2e
commit 4a7e7c2ad5
1 changed files with 13 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
net/netlink/af_netlink.c
View file

@ -829,12 +829,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
return 0; return 0;
} }
int netlink_sendskb(struct sock *sk, struct sk_buff *skb) static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{ {
int len = skb->len; int len = skb->len;
skb_queue_tail(&sk->sk_receive_queue, skb); skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk, len); sk->sk_data_ready(sk, len);
return len;
}
int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
{
int len = __netlink_sendskb(sk, skb);
sock_put(sk); sock_put(sk);
return len; return len;
} }
@ -957,8 +964,7 @@ static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
!test_bit(0, &nlk->state)) { !test_bit(0, &nlk->state)) {
skb_set_owner_r(skb, sk); skb_set_owner_r(skb, sk);
skb_queue_tail(&sk->sk_receive_queue, skb); __netlink_sendskb(sk, skb);
sk->sk_data_ready(sk, skb->len);
return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1); return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
} }
return -1; return -1;
@ -1698,10 +1704,8 @@ static int netlink_dump(struct sock *sk)
if (sk_filter(sk, skb)) if (sk_filter(sk, skb))
kfree_skb(skb); kfree_skb(skb);
else { else
skb_queue_tail(&sk->sk_receive_queue, skb); __netlink_sendskb(sk, skb);
sk->sk_data_ready(sk, skb->len);
}
return 0; return 0;
} }
@ -1715,10 +1719,8 @@ static int netlink_dump(struct sock *sk)
if (sk_filter(sk, skb)) if (sk_filter(sk, skb))
kfree_skb(skb); kfree_skb(skb);
else { else
skb_queue_tail(&sk->sk_receive_queue, skb); __netlink_sendskb(sk, skb);
sk->sk_data_ready(sk, skb->len);
}
if (cb->done) if (cb->done)
cb->done(cb); cb->done(cb);