From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:41472 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753730AbbIZTVL (ORCPT ); Sat, 26 Sep 2015 15:21:11 -0400 Subject: Patch "net: Fix skb csum races when peeking" has been added to the 3.10-stable tree To: herbert@gondor.apana.org.au, davem@davemloft.net, edumazet@google.com, gregkh@linuxfoundation.org Cc: , From: Date: Sat, 26 Sep 2015 12:21:10 -0700 Message-ID: <144329527096185@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled net: Fix skb csum races when peeking to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-fix-skb-csum-races-when-peeking.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Sat Sep 26 11:20:32 PDT 2015 From: Herbert Xu Date: Mon, 13 Jul 2015 20:01:42 +0800 Subject: net: Fix skb csum races when peeking From: Herbert Xu [ Upstream commit 89c22d8c3b278212eef6a8cc66b570bc840a6f5a ] When we calculate the checksum on the recv path, we store the result in the skb as an optimisation in case we need the checksum again down the line. This is in fact bogus for the MSG_PEEK case as this is done without any locking. So multiple threads can peek and then store the result to the same skb, potentially resulting in bogus skb states. This patch fixes this by only storing the result if the skb is not shared. This preserves the optimisations for the few cases where it can be done safely due to locking or other reasons, e.g., SIOCINQ. Signed-off-by: Herbert Xu Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/datagram.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -700,7 +700,8 @@ __sum16 __skb_checksum_complete_head(str if (likely(!sum)) { if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) netdev_rx_csum_fault(skb->dev); - skb->ip_summed = CHECKSUM_UNNECESSARY; + if (!skb_shared(skb)) + skb->ip_summed = CHECKSUM_UNNECESSARY; } return sum; } Patches currently in stable-queue which might be from herbert@gondor.apana.org.au are queue-3.10/net-fix-skb_set_peeked-use-after-free-bug.patch queue-3.10/ipv6-lock-socket-in-ip6_datagram_connect.patch queue-3.10/net-fix-skb-csum-races-when-peeking.patch queue-3.10/net-clone-skb-before-setting-peeked-flag.patch