]> www.infradead.org Git - users/jedix/linux-maple.git/commit
phonet: properly unshare skbs in phonet_rcv()
authorEric Dumazet <edumazet@google.com>
Tue, 12 Jan 2016 16:58:00 +0000 (08:58 -0800)
committerChuck Anderson <chuck.anderson@oracle.com>
Thu, 26 May 2016 22:43:26 +0000 (15:43 -0700)
commite1b41dbb5e8d9d97ab45639c1415e30ed372f161
tree07ea009b910a7f3f3f46bfa873bbcaa0299e2154
parenta9e889c735eef731df3fce53fb997277f3b0b498
phonet: properly unshare skbs in phonet_rcv()

Orabug: 23330559

[ Upstream commit 7aaed57c5c2890634cfadf725173c7c68ea4cb4f ]

Ivaylo Dimitrov reported a regression caused by commit 7866a621043f
("dev: add per net_device packet type chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen
without major crash.

But the root cause is that phonet_rcv() can queue skb without checking
if skb is shared or not.

Many thanks to Ivaylo Dimitrov for his help, diagnosis and tests.

Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Remi Denis-Courmont <courmisch@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2a1e5e4ab662a159e7e5dfd229597c4752d29b3c)

Signed-off-by: Dan Duval <dan.duval@oracle.com>
net/phonet/af_phonet.c