Eric Dumazet 1dc7b90f7c ipv6: tcp: fix race in IPV6_2292PKTOPTIONS
IPv6 TCP sockets store in np->pktoptions skbs, and use skb_set_owner_r()
to charge the skb to socket.

It means that destructor must be called while socket is locked.

Therefore, we cannot use skb_get() or atomic_inc(&skb->users)
to protect ourselves : kfree_skb() might race with other users
manipulating sk->sk_forward_alloc

Fix this race by holding socket lock for the duration of
ip6_datagram_recv_ctl()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-01-26 00:44:08 -08:00
..
2014-10-15 10:25:04 +10:30
2014-11-24 04:28:48 -05:00
2014-12-09 16:29:03 -05:00
2014-11-24 04:28:48 -05:00
2014-12-09 16:29:03 -05:00
2014-12-14 16:10:09 -08:00
2014-11-24 04:28:48 -05:00
2014-11-24 04:28:48 -05:00
2014-12-14 16:10:09 -08:00
2014-11-24 04:28:48 -05:00
2014-12-09 16:29:03 -05:00
2014-10-07 20:28:44 -04:00
2014-11-24 04:28:48 -05:00
2014-12-09 16:29:03 -05:00