lkml.org 
[lkml]   [2010]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH net-2.6 resent] af_packet: Don't use skb after dev_queue_xmit()
    tpacket_snd() can change and kfree an skb after dev_queue_xmit(),
    which is illegal.

    With debugging by: Stephen Hemminger <shemminger@vyatta.com>

    Reported-by: Michael Breuer <mbreuer@majjas.com>
    Tested-by: Michael Breuer <mbreuer@majjas.com>
    Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
    Acked-by: Stephen Hemminger <shemminger@vyatta.com>
    ---

    net/packet/af_packet.c | 8 +++-----
    1 files changed, 3 insertions(+), 5 deletions(-)

    diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    index e0516a2..aba2049 100644
    --- a/net/packet/af_packet.c
    +++ b/net/packet/af_packet.c
    @@ -1021,9 +1021,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)

    status = TP_STATUS_SEND_REQUEST;
    err = dev_queue_xmit(skb);
    - if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0))
    - goto out_xmit;
    packet_increment_head(&po->tx_ring);
    + if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0))
    + goto out_put;
    +
    len_sum += tp_len;
    } while (likely((ph != NULL) ||
    ((!(msg->msg_flags & MSG_DONTWAIT)) &&
    @@ -1033,9 +1034,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
    err = len_sum;
    goto out_put;

    -out_xmit:
    - skb->destructor = sock_wfree;
    - atomic_dec(&po->tx_ring.pending);
    out_status:
    __packet_set_status(po, ph, status);
    kfree_skb(skb);



    \
     
     \ /
      Last update: 2010-01-09 13:41    [W:0.021 / U:1.212 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site