Commit 2c52c1ed authored by Eric Dumazet's avatar Eric Dumazet Committed by Stefan Bader

net: initialize skb->peeked when cloning

BugLink: http://bugs.launchpad.net/bugs/1774173

commit b13dda9f upstream.

syzbot reported __skb_try_recv_from_queue() was using skb->peeked
while it was potentially unitialized.

We need to clear it in __skb_clone()

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJuerg Haefliger <juergh@canonical.com>
Signed-off-by: default avatarStefan Bader <stefan.bader@canonical.com>
parent 2cfbe3b9
...@@ -898,6 +898,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb) ...@@ -898,6 +898,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len; n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
n->cloned = 1; n->cloned = 1;
n->nohdr = 0; n->nohdr = 0;
n->peeked = 0;
n->destructor = NULL; n->destructor = NULL;
C(tail); C(tail);
C(end); C(end);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment