lkml.org 
[lkml]   [2017]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] net: ieee802154: fix net_device reference release too early
Date
This patch fixes the kernel oops when release net_device reference in 
advance. In function raw_sendmsg(i think the dgram_sendmsg has the same
problem), there is a race condition between dev_put and dev_queue_xmit
when the device is gong that maybe lead to dev_queue_ximt to see
an illegal net_device pointer.

So i think that dev_put should be behind of the dev_queue_xmit.

Also, explicit set skb->sk is needless, sock_alloc_send_skb is
already set it.

Signed-off-by: linzhang <xiaolou4617@gmail.com>
---
net/ieee802154/socket.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index eedba76..a60658c 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -301,15 +301,14 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
goto out_skb;

skb->dev = dev;
- skb->sk = sk;
skb->protocol = htons(ETH_P_IEEE802154);

- dev_put(dev);
-
err = dev_queue_xmit(skb);
if (err > 0)
err = net_xmit_errno(err);

+ dev_put(dev);
+
return err ?: size;

out_skb:
@@ -690,15 +689,14 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
goto out_skb;

skb->dev = dev;
- skb->sk = sk;
skb->protocol = htons(ETH_P_IEEE802154);

- dev_put(dev);
-
err = dev_queue_xmit(skb);
if (err > 0)
err = net_xmit_errno(err);

+ dev_put(dev);
+
return err ?: size;

out_skb:
--
1.8.3.1
\
 
 \ /
  Last update: 2017-05-18 09:51    [W:1.497 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site