projects
/
platform
/
kernel
/
linux-exynos.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
8f22ba6
)
af_rxrpc: Avoid setting up double-free on checksum error
author
Tim Smith
<tim@electronghost.co.uk>
Sun, 26 Jan 2014 11:39:28 +0000
(11:39 +0000)
committer
David Howells
<dhowells@redhat.com>
Sun, 26 Jan 2014 11:45:04 +0000
(11:45 +0000)
skb_kill_datagram() does not dequeue the skb when MSG_PEEK is unset.
This leaves a free'd skb on the queue, resulting a double-free later.
Without this, the following oops can occur:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000008
IP: [<
ffffffff8154fcf7
>] skb_dequeue+0x47/0x70
PGD 0
Oops: 0002 [#1] SMP
Modules linked in: af_rxrpc ...
CPU: 0 PID: 1191 Comm: listen Not tainted 3.12.0+ #4
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task:
ffff8801183536b0
ti:
ffff880035c92000
task.ti:
ffff880035c92000
RIP: 0010:[<
ffffffff8154fcf7
>] skb_dequeue+0x47/0x70
RSP: 0018:
ffff880035c93db8
EFLAGS:
00010097
RAX:
0000000000000246
RBX:
ffff8800d2754b00
RCX:
0000000000000000
RDX:
0000000000000000
RSI:
0000000000000202
RDI:
ffff8800d254c084
RBP:
ffff880035c93dd0
R08:
ffff880035c93cf0
R09:
ffff8800d968f270
R10:
0000000000000000
R11:
0000000000000293
R12:
ffff8800d254c070
R13:
ffff8800d254c084
R14:
ffff8800cd861240
R15:
ffff880119b39720
FS:
00007f37a969d740
(0000) GS:
ffff88011fc00000
(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
000000008005003b
CR2:
0000000000000008
CR3:
00000000d4413000
CR4:
00000000000006f0
Stack:
ffff8800d254c000
ffff8800d254c070
ffff8800d254c2c0
ffff880035c93df8
ffffffffa041a5b8
ffff8800cd844c80
ffffffffa04385a0
ffff8800cd844cb0
ffff880035c93e18
ffffffff81546cef
ffff8800d45fea00
0000000000000008
Call Trace:
[<
ffffffffa041a5b8
>] rxrpc_release+0x128/0x2e0 [af_rxrpc]
[<
ffffffff81546cef
>] sock_release+0x1f/0x80
[<
ffffffff81546d62
>] sock_close+0x12/0x20
[<
ffffffff811aaba1
>] __fput+0xe1/0x230
[<
ffffffff811aad3e
>] ____fput+0xe/0x10
[<
ffffffff810862cc
>] task_work_run+0xbc/0xe0
[<
ffffffff8106a3be
>] do_exit+0x2be/0xa10
[<
ffffffff8116dc47
>] ? do_munmap+0x297/0x3b0
[<
ffffffff8106ab8f
>] do_group_exit+0x3f/0xa0
[<
ffffffff8106ac04
>] SyS_exit_group+0x14/0x20
[<
ffffffff8166b069
>] system_call_fastpath+0x16/0x1b
Signed-off-by: Tim Smith <tim@electronghost.co.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
net/rxrpc/ar-recvmsg.c
patch
|
blob
|
history
diff --git
a/net/rxrpc/ar-recvmsg.c
b/net/rxrpc/ar-recvmsg.c
index
898492a
..
64cba2e
100644
(file)
--- a/
net/rxrpc/ar-recvmsg.c
+++ b/
net/rxrpc/ar-recvmsg.c
@@
-353,6
+353,10
@@
csum_copy_error:
if (continue_call)
rxrpc_put_call(continue_call);
rxrpc_kill_skb(skb);
+ if (!(flags & MSG_PEEK)) {
+ if (skb_dequeue(&rx->sk.sk_receive_queue) != skb)
+ BUG();
+ }
skb_kill_datagram(&rx->sk, skb, flags);
rxrpc_put_call(call);
return -EAGAIN;