linux/net/netlink
Herbert Xu 57b26930c7 netlink: Fix dump skb leak/double free
[ Upstream commit 92964c79b3 ]

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f340 ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
History 2016-07-12 08:48:21 -04:00
..
af_netlink.c netlink: Fix dump skb leak/double free 2016-07-12 08:48:21 -04:00
af_netlink.h netlink, mmap: transform mmap skb into full skb on taps 2015-10-27 09:33:01 -04:00
diag.c netlink: hold nl_sock_hash_lock during diag dump 2014-08-06 19:17:44 -07:00
genetlink.c genetlink: remove superfluous assignment 2014-06-02 10:36:18 -07:00
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile netlink: Diag core and basic socket info dumping (v2) 2013-03-21 12:38:03 -04:00