udp: properly cope with csum errors
authorEric Dumazet <edumazet@google.com>
Sun, 5 Feb 2017 17:25:24 +0000 (09:25 -0800)
committerDavid S. Miller <davem@davemloft.net>
Tue, 7 Feb 2017 16:19:00 +0000 (11:19 -0500)
commit69629464e0b587f3711739b3aa2bcdaf2e075276
treea0fc1812afaf992b01042e2bf081c455addc16ab
parent6a413e269b170d6d3bd32a71de4d5dcf987d6843
udp: properly cope with csum errors

Dmitry reported that UDP sockets being destroyed would trigger the
WARN_ON(atomic_read(&sk->sk_rmem_alloc)); in inet_sock_destruct()

It turns out we do not properly destroy skb(s) that have wrong UDP
checksum.

Thanks again to syzkaller team.

Fixes : 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/sock.h
net/core/datagram.c
net/ipv4/udp.c
net/ipv6/udp.c