* [PATCH] ping: Fix race in free in receive path
@ 2015-01-23 22:26 subashab
2015-01-23 23:07 ` Eric Dumazet
2015-01-27 8:05 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: subashab @ 2015-01-23 22:26 UTC (permalink / raw)
To: netdev; +Cc: edumazet
An exception is seen in ICMP ping receive path where the skb
destructor sock_rfree() tries to access a freed socket. This happens
because ping_rcv() releases socket reference with sock_put() and this
internally frees up the socket. Later icmp_rcv() will try to free the
skb and as part of this, skb destructor is called and which leads
to a kernel panic as the socket is freed already in ping_rcv().
-->|exception
-007|sk_mem_uncharge
-007|sock_rfree
-008|skb_release_head_state
-009|skb_release_all
-009|__kfree_skb
-010|kfree_skb
-011|icmp_rcv
-012|ip_local_deliver_finish
Fix this incorrect free by cloning this skb and processing this cloned
skb instead.
This patch was suggested by Eric Dumazet
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Eric Dumazet <edumazet@google.com>
---
net/ipv4/ping.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index c0d82f7..2a3720f 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -966,8 +966,11 @@ bool ping_rcv(struct sk_buff *skb)
sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
if (sk != NULL) {
+ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
pr_debug("rcv on socket %p\n", sk);
- ping_queue_rcv_skb(sk, skb_get(skb));
+ if (skb2)
+ ping_queue_rcv_skb(sk, skb2);
sock_put(sk);
return true;
}
--
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ping: Fix race in free in receive path
2015-01-23 22:26 [PATCH] ping: Fix race in free in receive path subashab
@ 2015-01-23 23:07 ` Eric Dumazet
2015-01-27 8:05 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2015-01-23 23:07 UTC (permalink / raw)
To: subashab; +Cc: netdev, edumazet
On Fri, 2015-01-23 at 22:26 +0000, subashab@codeaurora.org wrote:
> An exception is seen in ICMP ping receive path where the skb
> destructor sock_rfree() tries to access a freed socket. This happens
> because ping_rcv() releases socket reference with sock_put() and this
> internally frees up the socket. Later icmp_rcv() will try to free the
> skb and as part of this, skb destructor is called and which leads
> to a kernel panic as the socket is freed already in ping_rcv().
...
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
> Cc: Eric Dumazet <edumazet@google.com>
> ---
Thanks !
Signed-off-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ping: Fix race in free in receive path
2015-01-23 22:26 [PATCH] ping: Fix race in free in receive path subashab
2015-01-23 23:07 ` Eric Dumazet
@ 2015-01-27 8:05 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2015-01-27 8:05 UTC (permalink / raw)
To: subashab; +Cc: netdev, edumazet
From: subashab@codeaurora.org
Date: Fri, 23 Jan 2015 22:26:02 -0000
> An exception is seen in ICMP ping receive path where the skb
> destructor sock_rfree() tries to access a freed socket. This happens
> because ping_rcv() releases socket reference with sock_put() and this
> internally frees up the socket. Later icmp_rcv() will try to free the
> skb and as part of this, skb destructor is called and which leads
> to a kernel panic as the socket is freed already in ping_rcv().
>
> -->|exception
> -007|sk_mem_uncharge
> -007|sock_rfree
> -008|skb_release_head_state
> -009|skb_release_all
> -009|__kfree_skb
> -010|kfree_skb
> -011|icmp_rcv
> -012|ip_local_deliver_finish
>
> Fix this incorrect free by cloning this skb and processing this cloned
> skb instead.
>
> This patch was suggested by Eric Dumazet
>
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-01-27 8:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-23 22:26 [PATCH] ping: Fix race in free in receive path subashab
2015-01-23 23:07 ` Eric Dumazet
2015-01-27 8:05 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.