Patch "dccp: fix freeing skb too early for IPV6_RECVPKTINFO" has been added to the 4.4-stable tree
Subsystems (2)
This is a note to let you know that I've just added the patch titled
dccp: fix freeing skb too early for IPV6_RECVPKTINFO
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
dccp-fix-freeing-skb-too-early-for-ipv6_recvpktinfo.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Thu Feb 23 21:13:19 CET 2017
From: Andrey Konovalov <[email protected]>
Date: Thu, 16 Feb 2017 17:22:46 +0100
Subject: dccp: fix freeing skb too early for IPV6_RECVPKTINFO
From: Andrey Konovalov <[email protected]>
[ Upstream commit 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 ]
In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet is forcibly freed via __kfree_skb in dccp_rcv_state_process if dccp_v6_conn_request successfully returns.
However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb is saved to ireq->pktopts and the ref count for skb is incremented in dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed in dccp_rcv_state_process.
Fix by calling consume_skb instead of doing goto discard and therefore calling __kfree_skb.
Similar fixes for TCP:
fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed. 0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now simply consumed
--- net/dccp/input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/dccp/input.c +2 -1
@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *if (inet_csk (sk)->icsk_af_ops->conn_request (sk, skb) <0 )return 1 ; - goto discard; +consume_skb (skb); +return 0 ; }if (dh->dccph_type ==DCCP_PKT_RESET ) goto discard;
Patches currently in stable-queue which might be from [email protected] are
queue-4.4/dccp-fix-freeing-skb-too-early-for-ipv6_recvpktinfo.patch queue-4.4/ip-fix-ip_checksum-handling.patch queue-4.4/net-llc-avoid-bug_on-in-skb_orphan.patch