Commit 7e36763b authored Mar 03, 2008 by Frank Blaschka Committed by David S. Miller Mar 03, 2008

[NET]: Fix race in generic address resolution.



neigh_update sends skb from neigh->arp_queue while neigh_timer_handler
has increased skbs refcount and calls solicit with the
skb. neigh_timer_handler should not increase skbs refcount but make a
copy of the skb and do solicit with the copy.

Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c3d84a4d

net/core/neighbour.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -839,7 +839,7 @@ static void neigh_timer_handler(unsigned long arg)
		struct sk_buff *skb = skb_peek(&neigh->arp_queue);
		/* keep skb alive even if arp_queue overflows */
		if (skb)
		skb_get(skb);
		skb = skb_copy(skb, GFP_ATOMIC);
		write_unlock(&neigh->lock);
		neigh->ops->solicit(neigh, skb);
		atomic_inc(&neigh->probes);

Admin message