• subashab@codeaurora.org's avatar
    ping: Fix race in free in receive path · fc752f1f
    subashab@codeaurora.org authored
    An exception is seen in ICMP ping receive path where the skb
    destructor sock_rfree() tries to access a freed socket. This happens
    because ping_rcv() releases socket reference with sock_put() and this
    internally frees up the socket. Later icmp_rcv() will try to free the
    skb and as part of this, skb destructor is called and which leads
    to a kernel panic as the socket is freed already in ping_rcv().
    
    -->|exception
    -007|sk_mem_uncharge
    -007|sock_rfree
    -008|skb_release_head_state
    -009|skb_release_all
    -009|__kfree_skb
    -010|kfree_skb
    -011|icmp_rcv
    -012|ip_local_deliver_finish
    
    Fix this incorrect free by cloning this skb and processing this cloned
    skb instead.
    
    This patch was suggested by Eric Dumazet
    Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
    Cc: Eric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    fc752f1f
ping.c 28.9 KB