From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net 1/2] tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs Date: Tue, 21 Mar 2017 18:44:56 -0700 (PDT) Message-ID: <20170321.184456.1610083834421484383.davem@davemloft.net> References: <20170318210300.163288-1-soheil.kdev@gmail.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, zzoru007@gmail.com, soheil@google.com, edumazet@google.com, willemb@google.com To: soheil.kdev@gmail.com Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:59818 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750987AbdCVBo5 (ORCPT ); Tue, 21 Mar 2017 21:44:57 -0400 In-Reply-To: <20170318210300.163288-1-soheil.kdev@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Soheil Hassas Yeganeh Date: Sat, 18 Mar 2017 17:02:59 -0400 > From: Soheil Hassas Yeganeh > > __sock_recv_timestamp can be called for both normal skbs (for > receive timestamps) and for skbs on the error queue (for transmit > timestamps). > > Commit 1c885808e456 > (tcp: SOF_TIMESTAMPING_OPT_STATS option for SO_TIMESTAMPING) > assumes any skb passed to __sock_recv_timestamp are from > the error queue, containing OPT_STATS in the content of the skb. > This results in accessing invalid memory or generating junk > data. > > To fix this, set skb->pkt_type to PACKET_OUTGOING for packets > on the error queue. This is safe because on the receive path > on local sockets skb->pkt_type is never set to PACKET_OUTGOING. > With that, copy OPT_STATS from a packet, only if its pkt_type > is PACKET_OUTGOING. > > Fixes: 1c885808e456 ("tcp: SOF_TIMESTAMPING_OPT_STATS option for SO_TIMESTAMPING") > Reported-by: JongHwan Kim > Signed-off-by: Soheil Hassas Yeganeh > Signed-off-by: Eric Dumazet > Signed-off-by: Willem de Bruijn Applied and queued up for -stable.