diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-02-05 18:25:24 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-02-07 17:19:00 +0100 |
| commit | 69629464e0b587f3711739b3aa2bcdaf2e075276 (patch) | |
| tree | a0fc1812afaf992b01042e2bf081c455addc16ab /net/ipv6 | |
| parent | Merge branch 'net-Fix-on-stack-USB-buffers' (diff) | |
| download | linux-69629464e0b587f3711739b3aa2bcdaf2e075276.tar.xz linux-69629464e0b587f3711739b3aa2bcdaf2e075276.zip | |
udp: properly cope with csum errors
Dmitry reported that UDP sockets being destroyed would trigger the
WARN_ON(atomic_read(&sk->sk_rmem_alloc)); in inet_sock_destruct()
It turns out we do not properly destroy skb(s) that have wrong UDP
checksum.
Thanks again to syzkaller team.
Fixes : 7c13f97ffde6 ("udp: do fwd memory scheduling on dequeue")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/udp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 4d5c4eee4b3f..8990856f5101 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -441,7 +441,7 @@ try_again: return err; csum_copy_err: - if (!__sk_queue_drop_skb(sk, skb, flags)) { + if (!__sk_queue_drop_skb(sk, skb, flags, udp_skb_destructor)) { if (is_udp4) { UDP_INC_STATS(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite); |