Commit bd0900e5 authored by Herbert Xu's avatar Herbert Xu Committed by Luis Henriques

net: Fix skb csum races when peeking

commit 89c22d8c upstream.

When we calculate the checksum on the recv path, we store the
result in the skb as an optimisation in case we need the checksum
again down the line.

This is in fact bogus for the MSG_PEEK case as this is done without
any locking.  So multiple threads can peek and then store the result
to the same skb, potentially resulting in bogus skb states.

This patch fixes this by only storing the result if the skb is not
shared.  This preserves the optimisations for the few cases where
it can be done safely due to locking or other reasons, e.g., SIOCINQ.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent a3989452
...@@ -779,7 +779,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) ...@@ -779,7 +779,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
!skb->csum_complete_sw) !skb->csum_complete_sw)
netdev_rx_csum_fault(skb->dev); netdev_rx_csum_fault(skb->dev);
} }
skb->csum_valid = !sum; if (!skb_shared(skb))
skb->csum_valid = !sum;
return sum; return sum;
} }
EXPORT_SYMBOL(__skb_checksum_complete_head); EXPORT_SYMBOL(__skb_checksum_complete_head);
...@@ -799,11 +800,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb) ...@@ -799,11 +800,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
netdev_rx_csum_fault(skb->dev); netdev_rx_csum_fault(skb->dev);
} }
/* Save full packet checksum */ if (!skb_shared(skb)) {
skb->csum = csum; /* Save full packet checksum */
skb->ip_summed = CHECKSUM_COMPLETE; skb->csum = csum;
skb->csum_complete_sw = 1; skb->ip_summed = CHECKSUM_COMPLETE;
skb->csum_valid = !sum; skb->csum_complete_sw = 1;
skb->csum_valid = !sum;
}
return sum; return sum;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment