Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752004AbbHMEz4 (ORCPT ); Thu, 13 Aug 2015 00:55:56 -0400 Received: from mail-pd0-f176.google.com ([209.85.192.176]:35181 "EHLO mail-pd0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751934AbbHMEzy (ORCPT ); Thu, 13 Aug 2015 00:55:54 -0400 Date: Wed, 12 Aug 2015 21:55:50 -0700 From: Alexei Starovoitov To: Linus =?iso-8859-1?Q?L=FCssing?= Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Stephen Hemminger , "David S. Miller" , Herbert Xu , Brenden Blanco Subject: Re: [PATCH] net: fix wrong skb_get() usage / crash in IGMP/MLD parsing code Message-ID: <20150813045549.GA60201@Alexeis-MBP.westell.com> References: <1439438047-19441-1-git-send-email-linus.luessing@c0d3.blue> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1439438047-19441-1-git-send-email-linus.luessing@c0d3.blue> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1371 Lines: 29 On Thu, Aug 13, 2015 at 05:54:07AM +0200, Linus L?ssing wrote: > The recent refactoring of the IGMP and MLD parsing code into > ipv6_mc_check_mld() / ip_mc_check_igmp() introduced a potential crash / > BUG() invocation for bridges: > > I wrongly assumed that skb_get() could be used as a simple reference > counter for an skb which is not the case. skb_get() bears additional > semantics, a user count. This leads to a BUG() invocation in > pskb_expand_head() / kernel panic if pskb_may_pull() is called on an skb > with a user count greater than one - unfortunately the refactoring did > just that. > > Fixing this by removing the skb_get() call and changing the API: The > caller of ipv6_mc_check_mld() / ip_mc_check_igmp() now needs to > additionally check whether the returned skb_trimmed is a clone. > > Fixes: 9afd85c9e455 ("net: Export IGMP/MLD message validation code") > Reported-by: Brenden Blanco > Signed-off-by: Linus L?ssing I think the fix actually made the code easier to read. Thank you. Looks good to me. Acked-by: Alexei Starovoitov -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/