Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e36763b authored by Frank Blaschka's avatar Frank Blaschka Committed by David S. Miller
Browse files

[NET]: Fix race in generic address resolution. 



neigh_update sends skb from neigh->arp_queue while neigh_timer_handler
has increased skbs refcount and calls solicit with the
skb. neigh_timer_handler should not increase skbs refcount but make a
copy of the skb and do solicit with the copy.

Signed-off-by: default avatarFrank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c3d84a4d

net/core/neighbour.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -839,7 +839,7 @@ static void neigh_timer_handler(unsigned long arg) 
		struct sk_buff *skb = skb_peek(&neigh->arp_queue);

		struct sk_buff *skb = skb_peek(&neigh->arp_queue);

		/* keep skb alive even if arp_queue overflows */

		/* keep skb alive even if arp_queue overflows */

		if (skb)

		if (skb)

			skb_get(skb);

			skb = skb_copy(skb, GFP_ATOMIC);

		write_unlock(&neigh->lock);

		write_unlock(&neigh->lock);

		neigh->ops->solicit(neigh, skb);

		neigh->ops->solicit(neigh, skb);

		atomic_inc(&neigh->probes);

		atomic_inc(&neigh->probes);