Commit 1dc7b90f authored Jan 21, 2015 by Eric Dumazet Committed by David S. Miller Jan 26, 2015

ipv6: tcp: fix race in IPV6_2292PKTOPTIONS



IPv6 TCP sockets store in np->pktoptions skbs, and use skb_set_owner_r()
to charge the skb to socket.

It means that destructor must be called while socket is locked.

Therefore, we cannot use skb_get() or atomic_inc(&skb->users)
to protect ourselves : kfree_skb() might race with other users
manipulating sk->sk_forward_alloc

Fix this race by holding socket lock for the duration of
ip6_datagram_recv_ctl()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 607954b0

net/ipv6/ipv6_sockglue.c

+2 −6

Original line number	Diff line number	Diff line
		@@ -996,13 +996,9 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
		lock_sock(sk);
		skb = np->pktoptions;
		if (skb)
		atomic_inc(&skb->users);
		release_sock(sk);

		if (skb) {
		ip6_datagram_recv_ctl(sk, &msg, skb);
		kfree_skb(skb);
		} else {
		release_sock(sk);
		if (!skb) {
		if (np->rxopt.bits.rxinfo) {
		struct in6_pktinfo src_info;
		src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif :