diff options
| author | Alexander Duyck <alexander.h.duyck@intel.com> | 2014-09-10 18:05:42 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-09-12 17:51:25 -0400 |
| commit | bf7fa551e0ce507b82935055f4b4aa229be73eeb (patch) | |
| tree | 88068940307b6369cc1f6a2b346f6a070949f4bd /net/core | |
| parent | cab41c47d92851de71c74b1a7bdbf0fadf6ae4ba (diff) | |
| download | op-kernel-dev-bf7fa551e0ce507b82935055f4b4aa229be73eeb.zip op-kernel-dev-bf7fa551e0ce507b82935055f4b4aa229be73eeb.tar.gz | |
mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path
There is a possible issue with the use, or lack thereof of sk_refcnt and
sk_wmem_alloc in the wifi ack status functionality.
Specifically if a socket were to request acknowledgements, and the socket
were to have sk_refcnt drop to 0 resulting in it waiting on sk_wmem_alloc
to reach 0 it would be possible to have sock_queue_err_skb orphan the last
buffer, resulting in __sk_free being called on the socket. After this the
buffer is enqueued on sk_error_queue, however the queue has already been
flushed resulting in at least a memory leak, if not a data corruption.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/skbuff.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index c9da77a..c8259ac 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3628,9 +3628,14 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) serr->ee.ee_errno = ENOMSG; serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS; + /* take a reference to prevent skb_orphan() from freeing the socket */ + sock_hold(sk); + err = sock_queue_err_skb(sk, skb); if (err) kfree_skb(skb); + + sock_put(sk); } EXPORT_SYMBOL_GPL(skb_complete_wifi_ack); |
