From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, "Anton Blanchard" <anton@samba.org>,
"Eric Dumazet" <eric.dumazet@gmail.com>,
"David S. Miller" <davem@davemloft.net>, 单卫 <shanwei88@gmail.com>
Subject: [20/21] net: fix sk_forward_alloc corruptions
Date: Fri, 10 Feb 2012 14:47:59 -0800 [thread overview]
Message-ID: <20120210224852.571157423@clark.kroah.org> (raw)
In-Reply-To: <20120210224858.GA30752@kroah.com>
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2077 bytes --]
2.6.32-longterm review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <eric.dumazet@gmail.com>
commit 2903037400a26e7c0cc93ab75a7d62abfacdf485 upstream.
As David found out, sock_queue_err_skb() should be called with socket
lock hold, or we risk sk_forward_alloc corruption, since we use non
atomic operations to update this field.
This patch adds bh_lock_sock()/bh_unlock_sock() pair to three spots.
(BH already disabled)
1) skb_tstamp_tx()
2) Before calling ip_icmp_error(), in __udp4_lib_err()
3) Before calling ipv6_icmp_error(), in __udp6_lib_err()
Reported-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: 单卫 <shanwei88@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 4 ++++
net/ipv4/udp.c | 2 ++
net/ipv6/udp.c | 6 ++++--
3 files changed, 10 insertions(+), 2 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3008,7 +3008,11 @@ void skb_tstamp_tx(struct sk_buff *orig_
memset(serr, 0, sizeof(*serr));
serr->ee.ee_errno = ENOMSG;
serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
+
+ bh_lock_sock(sk);
err = sock_queue_err_skb(sk, skb);
+ bh_unlock_sock(sk);
+
if (err)
kfree_skb(skb);
}
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -441,7 +441,9 @@ void __udp4_lib_err(struct sk_buff *skb,
if (!harderr || sk->sk_state != TCP_ESTABLISHED)
goto out;
} else {
+ bh_lock_sock(sk);
ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
+ bh_unlock_sock(sk);
}
sk->sk_err = err;
sk->sk_error_report(sk);
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -337,9 +337,11 @@ void __udp6_lib_err(struct sk_buff *skb,
if (sk->sk_state != TCP_ESTABLISHED && !np->recverr)
goto out;
- if (np->recverr)
+ if (np->recverr) {
+ bh_lock_sock(sk);
ipv6_icmp_error(sk, skb, err, uh->dest, ntohl(info), (u8 *)(uh+1));
-
+ bh_unlock_sock(sk);
+ }
sk->sk_err = err;
sk->sk_error_report(sk);
out:
next prev parent reply other threads:[~2012-02-10 22:53 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-10 22:48 [00/21] 2.6.32.57-longterm review Greg KH
2012-02-10 22:47 ` [01/21] IB/mlx4: pass SMP vendor-specific attribute MADs to firmware Greg KH
2012-02-10 22:47 ` [02/21] mm/filemap_xip.c: fix race condition in xip_file_fault() Greg KH
2012-02-10 22:47 ` [03/21] NFSv4: Fix up the callers of nfs4_state_end_reclaim_reboot Greg KH
2012-02-10 22:47 ` [04/21] NFSv4: The state manager shouldnt exit on errors that were handled Greg KH
2012-02-10 22:47 ` [05/21] NFSv4: Ensure the state manager handles NFS4ERR_NO_GRACE correctly Greg KH
2012-02-10 22:47 ` [06/21] NFSv4: Handle NFS4ERR_GRACE when recovering an expired lease Greg KH
2012-02-10 22:47 ` [07/21] NFSv4: Fix open recovery Greg KH
2012-02-10 22:47 ` [08/21] rpc client can not deal with ENOSOCK, so translate it into ENOCONN Greg KH
2012-02-10 22:47 ` [09/21] udf: Mark LVID buffer as uptodate before marking it dirty Greg KH
2012-02-10 22:47 ` [10/21] drm/i915: Fix TV Out refresh rate Greg KH
2012-02-10 22:47 ` [11/21] eCryptfs: Infinite loop due to overflow in ecryptfs_write() Greg KH
2012-02-10 22:47 ` [12/21] atmel_lcdfb: fix usage of CONTRAST_CTR in suspend/resume Greg KH
2012-02-10 22:47 ` [13/21] Staging: asus_oled: fix image processing Greg KH
2012-02-10 22:47 ` [14/21] Staging: android: binder: Dont call dump_stack in binder_vma_open Greg KH
2012-02-10 22:47 ` [15/21] Staging: android: binder: Fix crashes when sharing a binder file between processes Greg KH
2012-02-10 22:47 ` [16/21] usb: gadget: zero: fix bug in loopback autoresume handling Greg KH
2012-02-10 22:47 ` [17/21] usb: Skip PCI USB quirk handling for Netlogic XLP Greg KH
2012-02-10 22:47 ` [18/21] USB: usbserial: add new PID number (0xa951) to the ftdi driver Greg KH
2012-02-10 22:47 ` [19/21] mmc: cb710 core: Add missing spin_lock_init for irq_lock of struct cb710_chip Greg KH
2012-02-10 22:47 ` Greg KH [this message]
2012-02-10 22:48 ` [21/21] net: sock_queue_err_skb() dont mess with sk_forward_alloc Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120210224852.571157423@clark.kroah.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=anton@samba.org \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=shanwei88@gmail.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox