Commit fa4c7fb2 authored by David S. Miller's avatar David S. Miller

Merge branch 'sock_hold-misuses'

Eric Dumazet says:

====================
net: fix possible sock_hold() misuses

skb_complete_wifi_ack() and skb_complete_tx_timestamp() currently
call sock_hold() on sockets that might have transitioned their sk_refcnt
to zero already.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 146d8fef 9ac25fc0
...@@ -3828,13 +3828,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, ...@@ -3828,13 +3828,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
if (!skb_may_tx_timestamp(sk, false)) if (!skb_may_tx_timestamp(sk, false))
return; return;
/* take a reference to prevent skb_orphan() from freeing the socket */ /* Take a reference to prevent skb_orphan() from freeing the socket,
sock_hold(sk); * but only if the socket refcount is not zero.
*/
if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
*skb_hwtstamps(skb) = *hwtstamps; *skb_hwtstamps(skb) = *hwtstamps;
__skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
sock_put(sk); sock_put(sk);
}
} }
EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
...@@ -3893,7 +3894,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) ...@@ -3893,7 +3894,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
{ {
struct sock *sk = skb->sk; struct sock *sk = skb->sk;
struct sock_exterr_skb *serr; struct sock_exterr_skb *serr;
int err; int err = 1;
skb->wifi_acked_valid = 1; skb->wifi_acked_valid = 1;
skb->wifi_acked = acked; skb->wifi_acked = acked;
...@@ -3903,14 +3904,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) ...@@ -3903,14 +3904,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
serr->ee.ee_errno = ENOMSG; serr->ee.ee_errno = ENOMSG;
serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS; serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
/* take a reference to prevent skb_orphan() from freeing the socket */ /* Take a reference to prevent skb_orphan() from freeing the socket,
sock_hold(sk); * but only if the socket refcount is not zero.
*/
if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
err = sock_queue_err_skb(sk, skb); err = sock_queue_err_skb(sk, skb);
sock_put(sk);
}
if (err) if (err)
kfree_skb(skb); kfree_skb(skb);
sock_put(sk);
} }
EXPORT_SYMBOL_GPL(skb_complete_wifi_ack); EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment