Commit 93bb64ea authored May 03, 2010 by Eric Dumazet Committed by David S. Miller May 03, 2010

net: skb_free_datagram_locked() fix



Commit 4b0b72f7 ( net: speedup udp receive path )
introduced a bug in skb_free_datagram_locked().

We should not skb_orphan() skb if we dont have the guarantee we are the
last skb user, this might happen with MSG_PEEK concurrent users.

To keep socket locked for the smallest period of time, we split
consume_skb() logic, inlined in skb_free_datagram_locked()

Reported-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f5460618

net/core/datagram.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -229,13 +229,18 @@ EXPORT_SYMBOL(skb_free_datagram);

		void skb_free_datagram_locked(struct sock sk, struct sk_buff skb)
		{
		if (likely(atomic_read(&skb->users) == 1))
		smp_rmb();
		else if (likely(!atomic_dec_and_test(&skb->users)))
		return;

		lock_sock_bh(sk);
		skb_orphan(skb);
		sk_mem_reclaim_partial(sk);
		unlock_sock_bh(sk);

		/* skb is now orphaned, might be freed outside of locked section */
		consume_skb(skb);
		/* skb is now orphaned, can be freed outside of locked section */
		__kfree_skb(skb);
		}
		EXPORT_SYMBOL(skb_free_datagram_locked);