From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Tue, 4 Aug 2015 07:42:47 +0000 (+0800)
Subject: net: Fix skb_set_peeked use-after-free bug
X-Git-Tag: omap-for-v4.3/fixes-merge-window~107^2~31
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a0a2a6602496a45ae838a96db8b8173794b5d398;p=pandora-kernel.git

net: Fix skb_set_peeked use-after-free bug

The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Brenden Blanco <bblanco@plumgrid.com>
Reviewed-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed