android_kernel_oneplus_msm8998/net/netlink
Herbert Xu 49543942be netlink: Fix dump skb leak/double free
[ Upstream commit 92964c79b357efd980812c4de5c1fd2ec8bb5520 ]

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f340 ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-06-24 10:18:16 -07:00
..
af_netlink.c netlink: Fix dump skb leak/double free 2016-06-24 10:18:16 -07:00
af_netlink.h netlink: Replace rhash_portid with bound 2015-09-24 12:07:08 -07:00
diag.c netlink: make nlmsg_end() and genlmsg_end() void 2015-01-18 01:03:45 -05:00
genetlink.c net/netlink: lockdep_genl_is_held can be boolean 2015-10-09 07:48:59 -07:00
Kconfig netlink: kconfig: move mmap i/o into netlink kconfig 2013-05-01 15:02:42 -04:00
Makefile netlink: Diag core and basic socket info dumping (v2) 2013-03-21 12:38:03 -04:00