Patch "udp: drop head states only when all skb references are gone" has been added to the 4.13-stable tree

PATCH [email protected] 1 participant 1 message Sep 15, 2017

Subsystems (3)

Networking Stable branch UDP

lore

Share & tools

lore

[email protected]

author maintainer Applied

2017-09-15 06:22 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

udp: drop head states only when all skb references are gone

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
udp-drop-head-states-only-when-all-skb-references-are-gone.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Thu Sep 14 23:20:44 PDT 2017

From: Paolo Abeni <[email protected]>
Date: Wed, 6 Sep 2017 14:44:36 +0200
Subject: udp: drop head states only when all skb references are gone

From: Paolo Abeni <[email protected]>

[ Upstream commit ca2c1418efe9f7fe37aa1f355efdf4eb293673ce ]

After commit 0ddf3fb2c43d ("udp: preserve skb->dst if required for IP options processing") we clear the skb head state as soon as the skb carrying them is first processed.

Since the same skb can be processed several times when MSG_PEEK is used, we can end up lacking the required head states, and eventually oopsing.

Fix this clearing the skb head state only when processing the last skb reference.

Reported-by Eric Dumazet <[email protected]>

Fixes 0ddf3fb2c43d ("udp: preserve skb->dst if required for IP options processing")

Signed-off-by Paolo Abeni <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/skbuff.h |    2 +-
 net/core/skbuff.c      |    9 +++------
 net/ipv4/udp.c         |    5 ++++-
 3 files changed, 8 insertions(+), 8 deletions(-)

include/linux/skbuff.h +1 -1

@@ -885,7 +885,7 @@ void kfree_skb(struct sk_buff *skb);
 void kfree_skb_list(struct sk_buff *segs);
 void skb_tx_error(struct sk_buff *skb);
 void consume_skb(struct sk_buff *skb);
-void consume_stateless_skb(struct sk_buff *skb);
+void __consume_stateless_skb(struct sk_buff *skb);
 void  __kfree_skb(struct sk_buff *skb);
 extern struct kmem_cache *skbuff_head_cache;

net/core/skbuff.c +3 -6

@@ -753,14 +753,11 @@ EXPORT_SYMBOL(consume_skb);
  *	consume_stateless_skb - free an skbuff, assuming it is stateless
  *	@skb: buffer to free
  *
- *	Works like consume_skb(), but this variant assumes that all the head
- *	states have been already dropped.
+ *	Alike consume_skb(), but this variant assumes that this is the last
+ *	skb reference and all the head states have been already dropped
  */
-void consume_stateless_skb(struct sk_buff *skb)
+void __consume_stateless_skb(struct sk_buff *skb)
 {
-	if (!skb_unref(skb))
-		return;
-
 	trace_consume_skb(skb);
 	if (likely(skb->head))
 		skb_release_data(skb);

net/ipv4/udp.c +4 -1

@@ -1386,12 +1386,15 @@ void skb_consume_udp(struct sock *sk, st
 		unlock_sock_fast(sk, slow);
 	}
 
+	if (!skb_unref(skb))
+		return;
+
 	/* In the more common cases we cleared the head states previously,
 	 * see __udp_queue_rcv_skb().
 	 */
 	if (unlikely(udp_skb_has_head_state(skb)))
 		skb_release_head_state(skb);
-	consume_stateless_skb(skb);
+	__consume_stateless_skb(skb);
 }
 EXPORT_SYMBOL_GPL(skb_consume_udp);

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/udp-drop-head-states-only-when-all-skb-references-are-gone.patch