mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-07-27 06:18:13 +00:00
Koen Kooi
2177f80076
Duplicate patches between PSP and 3.2.17 have been dropped from the 3.2.17 series Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
44 lines
1.3 KiB
Diff
44 lines
1.3 KiB
Diff
From 86e0251999e198af9ae73f58db4d5689f14862ec Mon Sep 17 00:00:00 2001
|
|
From: Eric Dumazet <eric.dumazet@gmail.com>
|
|
Date: Fri, 6 Apr 2012 10:49:10 +0200
|
|
Subject: [PATCH 068/165] net: fix a race in sock_queue_err_skb()
|
|
|
|
[ Upstream commit 110c43304db6f06490961529536c362d9ac5732f ]
|
|
|
|
As soon as an skb is queued into socket error queue, another thread
|
|
can consume it, so we are not allowed to reference skb anymore, or risk
|
|
use after free.
|
|
|
|
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
---
|
|
net/core/skbuff.c | 4 +++-
|
|
1 files changed, 3 insertions(+), 1 deletions(-)
|
|
|
|
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
|
|
index 3c30ee4..29cb392 100644
|
|
--- a/net/core/skbuff.c
|
|
+++ b/net/core/skbuff.c
|
|
@@ -3111,6 +3111,8 @@ static void sock_rmem_free(struct sk_buff *skb)
|
|
*/
|
|
int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
|
|
{
|
|
+ int len = skb->len;
|
|
+
|
|
if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
|
|
(unsigned)sk->sk_rcvbuf)
|
|
return -ENOMEM;
|
|
@@ -3125,7 +3127,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
|
|
|
|
skb_queue_tail(&sk->sk_error_queue, skb);
|
|
if (!sock_flag(sk, SOCK_DEAD))
|
|
- sk->sk_data_ready(sk, skb->len);
|
|
+ sk->sk_data_ready(sk, len);
|
|
return 0;
|
|
}
|
|
EXPORT_SYMBOL(sock_queue_err_skb);
|
|
--
|
|
1.7.7.6
|
|
|