Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Eric Dumazet 307cc358ee phonet: properly unshare skbs in phonet_rcv() ... commit 7aaed57c5c upstream. Ivaylo Dimitrov reported a regression caused by commit 7866a62104 ("dev: add per net_device packet type chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without major crash. But the root cause is that phonet_rcv() can queue skb without checking if skb is shared or not. Many thanks to Ivaylo Dimitrov for his help, diagnosis and tests. Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com> Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Remi Denis-Courmont <courmisch@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Luis Henriques <luis.henriques@canonical.com>		History 2016-01-28 10:51:50 +00:00
..
af_phonet.c	phonet: properly unshare skbs in phonet_rcv()	2016-01-28 10:51:50 +00:00
datagram.c	net: add build-time checks for msg->msg_name size	2014-01-18 23:04:16 -08:00
Kconfig	Phonet: kill the ST-Ericsson pipe controller Kconfig	2011-03-09 11:59:33 -08:00
Makefile	Net: phonet: Makefile: Remove deprecated kbuild goal definitions	2010-11-22 08:16:14 -08:00
pep-gprs.c	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
pep.c	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
pn_dev.c	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
pn_netlink.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
socket.c	seq_file: remove "%n" usage from seq_file users	2013-11-15 09:32:20 +09:00
sysctl.c	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00