lkml.org 
[lkml]   [2003]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH] kfree_skb() bug in 2.4.22
    From
    Date
    Hi all,

    I was debugging one of my iptables/netfilter modules yesterday and I
    came across this bug in kfree_skb(). One of my functions returns a
    struct skbuff * on success and NULL on failure. When it failed, the code
    calling said function attempted to free the struct skbuff *, which at
    that point was NULL. This produced a kernel panic. I investigated the
    problem and found that, not only should I be checking for a NULL pointer
    when freeing the struct skbuff *, but the actual cause of the panic was
    because kfree_skb() and kfree_skb_fast() do not check for skb==NULL,
    either. They immediately attempt to dereference the users field of the
    struct skbuff * in order to decrement that reference counter.

    I have come up with a patch that applies to both the 2.4.22 pristine
    source tree and the 2.4.23-pre6 source tree that solves this issue (see
    below). I tried to follow Documentation/SubmittingPatches to the letter;
    please let me know if I failed this in some way. Thanks :)

    P.S. I wasn't sure who exactly maintains this particular code; that's
    why I just sent it to everyone listed in MAINTAINERS remotely associated
    with include/linux/skbuff.h ;)


    --- include/linux/skbuff.h.orig 2003-10-08 07:52:31.000000000 -0400
    +++ include/linux/skbuff.h 2003-10-08 07:52:52.000000000 -0400
    @@ -293,6 +293,8 @@

    static inline void kfree_skb(struct sk_buff *skb)
    {
    + if (!skb)
    + return;
    if (atomic_read(&skb->users) == 1 || atomic_dec_and_test(&skb->users))
    __kfree_skb(skb);
    }
    @@ -300,6 +302,8 @@
    /* Use this if you didn't touch the skb state [for fast switching] */
    static inline void kfree_skb_fast(struct sk_buff *skb)
    {
    + if (!skb)
    + return;
    if (atomic_read(&skb->users) == 1 || atomic_dec_and_test(&skb->users))
    kfree_skbmem(skb);
    }

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:49    [W:2.165 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site