1
0
Fork 0
remarkable-linux/net/netlink
Herbert Xu e39cd93be0 netlink: Fix dump skb leak/double free
[ Upstream commit 92964c79b3 ]

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f340 ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
2016-07-10 23:07:28 -04:00
..
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile netlink: Diag core and basic socket info dumping (v2) 2013-03-21 12:38:03 -04:00
af_netlink.c netlink: Fix dump skb leak/double free 2016-07-10 23:07:28 -04:00
af_netlink.h netlink: Replace rhash_portid with bound 2015-10-03 13:49:18 +02:00
diag.c netlink: make nlmsg_end() and genlmsg_end() void 2015-01-18 01:03:45 -05:00
genetlink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-01-27 16:59:56 -08:00