llc: llc_cmsg_rcv was getting called after sk_eat_skb. (9cef310f) · Commits · 戴 / test

Received non stream protocol packets were calling llc_cmsg_rcv that used a skb after that skb was released by sk_eat_skb. This caused received STP packets to generate kernel panics. Signed-off-by:

Alexandru Juncu <ajuncu@ixiacom.com> Signed-off-by:

Kunjan Naik <knaik@ixiacom.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/llc/af_llc.c

+10 −4

Original line number	Diff line number	Diff line
		@@ -833,15 +833,15 @@ static int llc_ui_recvmsg(struct kiocb iocb, struct socket sock,
		copied += used;
		len -= used;

		/* For non stream protcols we get one packet per recvmsg call */
		if (sk->sk_type != SOCK_STREAM)
		goto copy_uaddr;

		if (!(flags & MSG_PEEK)) {
		sk_eat_skb(sk, skb, 0);
		*seq = 0;
		}

		/* For non stream protcols we get one packet per recvmsg call */
		if (sk->sk_type != SOCK_STREAM)
		goto copy_uaddr;

		/* Partial read */
		if (used + offset < skb->len)
		continue;
		@@ -857,6 +857,12 @@ copy_uaddr:
		}
		if (llc_sk(sk)->cmsg_flags)
		llc_cmsg_rcv(msg, skb);

		if (!(flags & MSG_PEEK)) {
		sk_eat_skb(sk, skb, 0);
		*seq = 0;
		}

		goto out;
		}

Admin message