Messages in this thread Patch in this message | | | Subject | Re: ip_queue_xmit(): dangling skb pointer (with patch) | From | Henner Eisen <> | Date | 06 Sep 1999 23:49:28 +0200 |
| |
Hi,
maybe my previous posting got lost somehow (didn't receive any reponse).
There is a bug in ip_output.c:ip_queue_xmit(). After re_allocation of headroom, skb_set_owner_w() is called for the old and already freed skb instead of the new one. This (a) referes a possibly dangling pointer and (b) might cause bogus socket memory accounting. The following patch will fix this. (It's against 2.2.12, but should also apply against current 2.3.x).
--- linux-2.2.12/net/ipv4/ip_output.c.orig Tue Aug 31 18:03:14 1999 +++ linux-2.2.12/net/ipv4/ip_output.c Tue Aug 31 18:04:12 1999 @@ -315,17 +315,17 @@ if (skb_headroom(skb) < dev->hard_header_len && dev->hard_header) { struct sk_buff *skb2; skb2 = skb_realloc_headroom(skb, (dev->hard_header_len + 15) & ~15); kfree_skb(skb); if (skb2 == NULL) return; if (sk) - skb_set_owner_w(skb, sk); + skb_set_owner_w(skb2, sk); skb = skb2; iph = skb->nh.iph; } /* Do we need to fragment. Again this is inefficient. We * need to somehow lock the original buffer and use bits of it. */ if (tot_len > rt->u.dst.pmtu)
BTW: Is there any reason why the setting of the new skb's ownership is not done within skb_realloc_headroom() itself?
Henner
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |