Merge "net: Fix skb_set_peeked use-after-free bug" (6817f068) · Commits · e / devices / android_kernel_xiaomi_markw

net/core/datagram.c

+7 −6

Original line number	Diff line number	Diff line
		@@ -130,12 +130,12 @@ out_noerr:
		goto out;
		}

		static int skb_set_peeked(struct sk_buff *skb)
		static struct sk_buff skb_set_peeked(struct sk_buff skb)
		{
		struct sk_buff *nskb;

		if (skb->peeked)
		return 0;
		return skb;

		/* We have to unshare an skb before modifying it. */
		if (!skb_shared(skb))
		@@ -143,7 +143,7 @@ static int skb_set_peeked(struct sk_buff *skb)

		nskb = skb_clone(skb, GFP_ATOMIC);
		if (!nskb)
		return -ENOMEM;
		return ERR_PTR(-ENOMEM);

		skb->prev->next = nskb;
		skb->next->prev = nskb;
		@@ -156,7 +156,7 @@ static int skb_set_peeked(struct sk_buff *skb)
		done:
		skb->peeked = 1;

		return 0;
		return skb;
		}

		/**
		@@ -228,8 +228,9 @@ struct sk_buff __skb_recv_datagram(struct sock sk, unsigned int flags,
		continue;
		}

		error = skb_set_peeked(skb);
		if (error)
		skb = skb_set_peeked(skb);
		error = PTR_ERR(skb);
		if (IS_ERR(skb))
		goto unlock_err;

		atomic_inc(&skb->users);