Herbert Xu 738ac1ebb9 net: Clone skb before setting peeked flag ...

Shared skbs must not be modified and this is crucial for broadcast
and/or multicast paths where we use it as an optimisation to avoid
unnecessary cloning.

The function skb_recv_datagram breaks this rule by setting peeked
without cloning the skb first.  This causes funky races which leads
to double-free.

This patch fixes this by cloning the skb and replacing the skb
in the list when setting skb->peeked.

Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv")
Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

2015-07-15 15:59:58 -07:00

..

datagram.c

net: Clone skb before setting peeked flag

2015-07-15 15:59:58 -07:00

dev_addr_lists.c

net: fix spelling for synchronized

2014-11-18 15:26:32 -05:00

dev_ioctl.c

dev_ioctl: use sizeof(x) instead of sizeof x

2014-11-18 15:27:32 -05:00

dev.c

net: call rcu_read_lock early in process_backlog

2015-07-10 18:16:36 -07:00

drop_monitor.c

net: Replace get_cpu_var through this_cpu_ptr

2014-08-26 13:45:47 -04:00

dst.c

dst: no need to take reference on DST_NOCACHE dsts

2014-12-09 16:08:17 -05:00

ethtool.c

net/ethtool: Add current supported tunable options

2015-06-11 00:36:37 -07:00

fib_rules.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-04-06 22:34:15 -04:00

filter.c

bpf: disallow bpf tc programs access current->pid,uid

2015-06-15 20:51:20 -07:00

flow_dissector.c

flow_dissector: Pre-initialize ip_proto in __skb_flow_dissect()

2015-06-28 16:53:54 -07:00

flow.c

flowcache: Fix kernel panic in flow_cache_flush_task

2015-02-05 14:38:53 -08:00

gen_estimator.c

net_sched: gen_estimator: extend pps limit

2015-07-08 13:59:20 -07:00

gen_stats.c

gen_stats.c: Duplicate xstats buffer for later use

2015-02-19 15:45:53 -05:00

link_watch.c

dev: introduce dev_get_iflink()

2015-04-02 14:04:59 -04:00

Makefile

net: bury net/core/iovec.c - nothing in there is used anymore

2015-02-04 01:34:15 -05:00

neighbour.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-06-24 02:58:51 -07:00

net_namespace.c

netns: make nsid_lock per net

2015-05-17 23:41:11 -04:00

net-procfs.c

…

net-sysfs.c

switchdev: don't use anonymous union on switchdev attr/obj structs

2015-05-13 14:20:59 -04:00

net-sysfs.h

…

net-traces.c

…

netclassid_cgroup.c

cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes

2014-07-15 11:05:09 -04:00

netevent.c

netevent: remove automatic variable in register_netevent_notifier()

2015-05-31 00:03:21 -07:00

netpoll.c

net: rename vlan_tx_* helpers since "tx" is misleading there

2015-01-13 17:51:08 -05:00

netprio_cgroup.c

cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes

2014-07-15 11:05:09 -04:00

pktgen.c

net: pktgen: kill the "Wait for kthread_stop" code in pktgen_thread_worker()

2015-07-09 15:05:32 -07:00

ptp_classifier.c

net: filter: split 'struct sk_filter' into socket and bpf parts

2014-08-02 15:03:58 -07:00

request_sock.c

net: convert syn_wait_lock to a spinlock

2015-03-23 16:52:26 -04:00

rtnetlink.c

rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS

2015-07-15 15:53:27 -07:00

scm.c

net: introduce helper macro for_each_cmsghdr

2014-12-10 22:41:55 -05:00

secure_seq.c

net: remove a sparse error in secure_dccpv6_sequence_number()

2015-05-25 22:55:37 -04:00

skbuff.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-06-13 23:56:52 -07:00

sock_diag.c

sock_diag: define destruction multicast groups

2015-06-15 19:49:22 -07:00

sock.c

sock_diag: don't broadcast kernel sockets

2015-06-30 10:00:26 -07:00

stream.c

tcp: set SOCK_NOSPACE under memory pressure

2015-05-09 17:38:36 -04:00

sysctl_net_core.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-03-20 18:51:09 -04:00

timestamping.c

net-timestamp: Make the clone operation stand-alone from phy timestamping

2014-09-05 17:43:45 -07:00

tso.c

net: tso: fix unaligned access to crafted TCP header in helper API

2014-10-22 12:52:55 -04:00

utils.c

net: fix inet_proto_csum_replace4() sparse errors

2015-05-25 22:56:47 -04:00