net: fix sk_forward_alloc corruption

[ Upstream commit: 9d410c796067686b1e032d54ce475b7055537138 ]

On UDP sockets, we must call skb_free_datagram() with socket locked,
or risk sk_forward_alloc corruption. This requirement is not respected
in SUNRPC.

Add a convenient helper, skb_free_datagram_locked() and use it in SUNRPC

Reported-by: Francis Moreau <francis.moro@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index f2c69a2cca172aff841e6ce97656d5fa9cb412a9..ff06fb2b159f35cc063010c53ee14324f75f5b48 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1761,6 +1761,8 @@ extern int               skb_copy_datagram_const_iovec(const struct sk_buff *from,
                                                     int to_offset,
                                                     int size);
 extern void           skb_free_datagram(struct sock *sk, struct sk_buff *skb);
+extern void           skb_free_datagram_locked(struct sock *sk,
+                                               struct sk_buff *skb);
 extern int            skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
                                         unsigned int flags);
 extern __wsum         skb_checksum(const struct sk_buff *skb, int offset,

diff --git a/net/core/datagram.c b/net/core/datagram.c
index b0fe69211eefef1e18224fa123d2b13498bffefa..caeb2852c3c8b52232753700d4e50950cb127fc0 100644 (file)
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -223,6 +223,15 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
        consume_skb(skb);
        sk_mem_reclaim_partial(sk);
 }
+EXPORT_SYMBOL(skb_free_datagram);
+
+void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
+{
+       lock_sock(sk);
+       skb_free_datagram(sk, skb);
+       release_sock(sk);
+}
+EXPORT_SYMBOL(skb_free_datagram_locked);
 
 /**
  *     skb_kill_datagram - Free a datagram skbuff forcibly
@@ -749,5 +758,4 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
 EXPORT_SYMBOL(datagram_poll);
 EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec);
 EXPORT_SYMBOL(skb_copy_datagram_iovec);
-EXPORT_SYMBOL(skb_free_datagram);
 EXPORT_SYMBOL(skb_recv_datagram);

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 3ac5ff0d70071a807cf3780240e116db3eb4d934..00d1f6d82d262aad359c024b321fb8523fcefbd2 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -987,9 +987,7 @@ try_again:
                err = ulen;
 
 out_free:
-       lock_sock(sk);
-       skb_free_datagram(sk, skb);
-       release_sock(sk);
+       skb_free_datagram_locked(sk, skb);
 out:
        return err;
 

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 33b59bd92c4dc18667a6f0bf94fc7ac4282b4323..333a6ec38bf3a1e7ce7ced2191046824b72dc619 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -288,9 +288,7 @@ try_again:
                err = ulen;
 
 out_free:
-       lock_sock(sk);
-       skb_free_datagram(sk, skb);
-       release_sock(sk);
+       skb_free_datagram_locked(sk, skb);
 out:
        return err;
 

diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 23128ee191ae707973345e3438ccf9e055009bed..39e37bca25765afbdafffcd007f704068d707e79 100644 (file)
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -110,7 +110,7 @@ static void svc_release_skb(struct svc_rqst *rqstp)
                rqstp->rq_xprt_ctxt = NULL;
 
                dprintk("svc: service %p, releasing skb %p\n", rqstp, skb);
-               skb_free_datagram(svsk->sk_sk, skb);
+               skb_free_datagram_locked(svsk->sk_sk, skb);
        }
 }
 
@@ -537,7 +537,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                        printk("rpcsvc: received unknown control message:"
                               "%d/%d\n",
                               cmh->cmsg_level, cmh->cmsg_type);
-               skb_free_datagram(svsk->sk_sk, skb);
+               skb_free_datagram_locked(svsk->sk_sk, skb);
                return 0;
        }
        svc_udp_get_dest_address(rqstp, cmh);
@@ -548,18 +548,18 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) {
                        local_bh_enable();
                        /* checksum error */
-                       skb_free_datagram(svsk->sk_sk, skb);
+                       skb_free_datagram_locked(svsk->sk_sk, skb);
                        return 0;
                }
                local_bh_enable();
-               skb_free_datagram(svsk->sk_sk, skb);
+               skb_free_datagram_locked(svsk->sk_sk, skb);
        } else {
                /* we can use it in-place */
                rqstp->rq_arg.head[0].iov_base = skb->data +
                        sizeof(struct udphdr);
                rqstp->rq_arg.head[0].iov_len = len;
                if (skb_checksum_complete(skb)) {
-                       skb_free_datagram(svsk->sk_sk, skb);
+                       skb_free_datagram_locked(svsk->sk_sk, skb);
                        return 0;
                }
                rqstp->rq_xprt_ctxt = skb;