| From abbd9f13d87c31688d37c247dd50a36dfaa360ac Mon Sep 17 00:00:00 2001 |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Fri, 3 Mar 2017 21:01:02 -0800 |
| Subject: [PATCH] net: fix socket refcounting in skb_complete_wifi_ack() |
| |
| commit dd4f10722aeb10f4f582948839f066bebe44e5fb upstream. |
| |
| TX skbs do not necessarily hold a reference on skb->sk->sk_refcnt |
| By the time TX completion happens, sk_refcnt might be already 0. |
| |
| sock_hold()/sock_put() would then corrupt critical state, like |
| sk_wmem_alloc. |
| |
| Fixes: bf7fa551e0ce ("mac80211: Resolve sk_refcnt/sk_wmem_alloc issue in wifi ack path") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Cc: Alexander Duyck <alexander.h.duyck@intel.com> |
| Cc: Johannes Berg <johannes@sipsolutions.net> |
| Cc: Soheil Hassas Yeganeh <soheil@google.com> |
| Cc: Willem de Bruijn <willemb@google.com> |
| Acked-by: Soheil Hassas Yeganeh <soheil@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/core/skbuff.c b/net/core/skbuff.c |
| index 3864b4b68fa1..473bf4a5b80a 100644 |
| --- a/net/core/skbuff.c |
| +++ b/net/core/skbuff.c |
| @@ -3847,7 +3847,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) |
| { |
| struct sock *sk = skb->sk; |
| struct sock_exterr_skb *serr; |
| - int err; |
| + int err = 1; |
| |
| skb->wifi_acked_valid = 1; |
| skb->wifi_acked = acked; |
| @@ -3857,14 +3857,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) |
| serr->ee.ee_errno = ENOMSG; |
| serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS; |
| |
| - /* take a reference to prevent skb_orphan() from freeing the socket */ |
| - sock_hold(sk); |
| - |
| - err = sock_queue_err_skb(sk, skb); |
| + /* Take a reference to prevent skb_orphan() from freeing the socket, |
| + * but only if the socket refcount is not zero. |
| + */ |
| + if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { |
| + err = sock_queue_err_skb(sk, skb); |
| + sock_put(sk); |
| + } |
| if (err) |
| kfree_skb(skb); |
| - |
| - sock_put(sk); |
| } |
| EXPORT_SYMBOL_GPL(skb_complete_wifi_ack); |
| |
| -- |
| 2.12.0 |
| |