net: Fix skb_set_peeked use-after-free bug
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 4 Aug 2015 07:42:47 +0000 (15:42 +0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 7 Aug 2015 04:55:47 +0000 (21:55 -0700)
commita0a2a6602496a45ae838a96db8b8173794b5d398
tree5508d9f02066c30854b0c88b82fffc03c857adef
parent14d2b7c1a96ef37eb571599c73d4a1a606b964d6
net: Fix skb_set_peeked use-after-free bug

The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Brenden Blanco <bblanco@plumgrid.com>
Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/datagram.c