Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision db61ecc3352d72513c1b07805bd6f760e30c001b authored by Tommy S. Christensen on 19 May 2005, 19:46:59 UTC, committed by David S. Miller on 19 May 2005, 19:46:59 UTC 
[NETLINK]: Fix race with recvmsg().
 
This bug causes:

assertion (!atomic_read(&sk->sk_rmem_alloc)) failed at net/netlink/af_netlink.c (122)

What's happening is that:

1) The skb is sent to socket 1.
2) Someone does a recvmsg on socket 1 and drops the ref on the skb.
   Note that the rmalloc is not returned at this point since the
   skb is still referenced.
3) The same skb is now sent to socket 2.

This version of the fix resurrects the skb_orphan call that was moved
out, last time we had 'shared-skb troubles'. It is practically a no-op
in the common case, but still prevents the possible race with recvmsg.

Signed-off-by: Tommy S. Christensen <tommy.christensen@tpack.net>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 1eda339
History
Tip revision: db61ecc3352d72513c1b07805bd6f760e30c001b authored by Tommy S. Christensen on 19 May 2005, 19:46:59 UTC
[NETLINK]: Fix race with recvmsg().
Tip revision: db61ecc
File Mode Size
arm
core
drivers
i2c
isa
mips
oss
parisc
pci
pcmcia
ppc
sparc
synth
usb
Kconfig -rw-r--r-- 2.4 KB
Makefile -rw-r--r-- 346 bytes
last.c -rw-r--r-- 1.3 KB
sound_core.c -rw-r--r-- 13.5 KB
sound_firmware.c -rw-r--r-- 1.7 KB
back to top