Messages in this thread | | | Date | Mon, 01 Jul 2013 13:36:15 -0700 (PDT) | Subject | Re: kernel panic in skb_copy_bits | From | David Miller <> |
| |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Fri, 28 Jun 2013 02:37:42 -0700
> [PATCH] neighbour: fix a race in neigh_destroy() > > There is a race in neighbour code, because neigh_destroy() uses > skb_queue_purge(&neigh->arp_queue) without holding neighbour lock, > while other parts of the code assume neighbour rwlock is what > protects arp_queue > > Convert all skb_queue_purge() calls to the __skb_queue_purge() variant > > Use __skb_queue_head_init() instead of skb_queue_head_init() > to make clear we do not use arp_queue.lock > > And hold neigh->lock in neigh_destroy() to close the race. > > Reported-by: Joe Jin <joe.jin@oracle.com> > Signed-off-by: Eric Dumazet <edumazet@google.com>
Applied and queued up for -stable, thanks Eric.
| |