From: David Miller <davem@davemloft.net>
To: johannes@sipsolutions.net
Cc: netdev@vger.kernel.org, richardcochran@gmail.com
Subject: Re: [RFC] net: remove erroneous sk null assignment in timestamping
Date: Fri, 07 Oct 2011 13:33:56 -0400 (EDT) [thread overview]
Message-ID: <20111007.133356.489094996618032061.davem@davemloft.net> (raw)
In-Reply-To: <1318007501.3988.20.camel@jlt3.sipsolutions.net>
From: Johannes Berg <johannes@sipsolutions.net>
Date: Fri, 07 Oct 2011 19:11:41 +0200
> From: Johannes Berg <johannes.berg@intel.com>
>
> skb->sk is obviously required to be non-NULL
> when we get into skb_complete_tx_timestamp().
> sock_queue_err_skb() will call skb_orphan()
> first thing which sets skb->sk = NULL itself.
> This may crash if the skb is still charged to
> the socket (skb->destructor is sk_wfree).
>
> The assignment here thus seems to not only be
> pointless (due to the skb_orphan() call) but
> also dangerous (due to the crash).
>
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
It looks like skb_clone_tx_timestamp() sets clone->sk without any
proper refcounting, so I bet this NULL'ing it out is working
around that bug.
The TX side of this infrastructure seems very poorly tested.
next prev parent reply other threads:[~2011-10-07 17:35 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-07 17:11 [RFC] net: remove erroneous sk null assignment in timestamping Johannes Berg
2011-10-07 17:33 ` David Miller [this message]
2011-10-07 17:40 ` Johannes Berg
2011-10-07 17:47 ` Johannes Berg
2011-10-07 17:53 ` Johannes Berg
2011-10-07 18:42 ` Johannes Berg
2011-10-08 7:59 ` Richard Cochran
2011-10-08 7:57 ` Richard Cochran
2011-10-08 8:16 ` Johannes Berg
2011-10-08 8:57 ` Eric Dumazet
2011-10-08 10:32 ` Johannes Berg
2011-10-11 13:34 ` Richard Cochran
2011-10-08 10:35 ` Richard Cochran
2011-10-12 18:36 ` [PATCH 1/1] net: hold sock reference while processing tx timestamps Richard Cochran
2011-10-12 19:25 ` Eric Dumazet
2011-10-12 19:27 ` Johannes Berg
2011-10-12 19:52 ` Eric Dumazet
2011-10-13 8:54 ` Johannes Berg
2011-10-13 4:51 ` Richard Cochran
2011-10-13 9:46 ` [PATCH 0/3] net: time stamping fixes Richard Cochran
2011-10-19 4:16 ` David Miller
2011-10-19 5:15 ` Johannes Berg
2011-10-19 11:50 ` Richard Cochran
2011-10-19 12:33 ` Eric Dumazet
2011-10-19 12:38 ` Eric Dumazet
2011-10-19 12:58 ` Johannes Berg
2011-10-19 13:09 ` Johannes Berg
2011-10-19 13:25 ` Eric Dumazet
2011-10-19 13:35 ` Johannes Berg
2011-10-19 13:44 ` Eric Dumazet
2011-10-19 13:57 ` Johannes Berg
2011-10-19 14:08 ` Eric Dumazet
2011-10-19 14:24 ` Johannes Berg
2011-10-19 14:27 ` Richard Cochran
2011-10-19 14:33 ` Eric Dumazet
2011-10-19 13:21 ` Eric Dumazet
2011-10-19 13:25 ` Johannes Berg
2011-10-19 13:27 ` Eric Dumazet
2011-10-19 13:32 ` Johannes Berg
2011-10-19 14:25 ` Richard Cochran
2011-10-13 9:46 ` [PATCH 1/3] net: hold sock reference while processing tx timestamps Richard Cochran
2011-10-19 4:42 ` Eric Dumazet
2011-10-13 9:46 ` [PATCH 2/3] dp83640: use proper function to free transmit time stamping packets Richard Cochran
2011-10-19 4:47 ` Eric Dumazet
2011-10-13 9:46 ` [PATCH 3/3] dp83640: free packet queues on remove Richard Cochran
2011-10-19 4:48 ` Eric Dumazet
2011-10-21 10:49 ` [PATCH v2 0/3] net: time stamping fixes Richard Cochran
2011-10-21 10:49 ` [PATCH v2 1/3] net: hold sock reference while processing tx timestamps Richard Cochran
2011-10-21 11:31 ` Eric Dumazet
2011-10-24 6:55 ` David Miller
2011-10-21 11:44 ` Johannes Berg
2011-10-21 10:49 ` [PATCH v2 2/3] dp83640: use proper function to free transmit time stamping packets Richard Cochran
2011-10-24 6:55 ` David Miller
2011-10-24 17:47 ` Richard Cochran
2011-10-24 23:16 ` David Miller
2011-10-21 10:49 ` [PATCH v2 3/3] dp83640: free packet queues on remove Richard Cochran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111007.133356.489094996618032061.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=johannes@sipsolutions.net \
--cc=netdev@vger.kernel.org \
--cc=richardcochran@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).