net/packet: fix missing net_device reference release

Submitted by Douglas Caetano dos Santos on May 12, 2017, 6:19 p.m.

Details

Message ID 7daebe52-8542-87cb-551a-1a5b4912f140@taghos.com.br
State Accepted
Delegated to: David Miller
Headers show

Commit Message

Douglas Caetano dos Santos May 12, 2017, 6:19 p.m.
When using a TX ring buffer, if an error occurs processing a control
message (e.g. invalid message), the net_device reference is not
released.

Fixes c14ac9451c348 ("sock: enable timestamping using control messages")
Signed-off-by: Douglas Caetano dos Santos <douglascs@taghos.com.br>
---
 net/packet/af_packet.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

Comments

Soheil Hassas Yeganeh May 12, 2017, 8:11 p.m.
On Fri, May 12, 2017 at 2:19 PM, Douglas Caetano dos Santos
<douglascs@taghos.com.br> wrote:
> When using a TX ring buffer, if an error occurs processing a control
> message (e.g. invalid message), the net_device reference is not
> released.
>
> Fixes c14ac9451c348 ("sock: enable timestamping using control messages")
> Signed-off-by: Douglas Caetano dos Santos <douglascs@taghos.com.br>

Acked-by: Soheil Hassas Yeganeh <soheil@google.com>

> ---
>  net/packet/af_packet.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index f4001763134d..e3eeed19cc7a 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -2658,13 +2658,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
>                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
>         }
>
> -       sockc.tsflags = po->sk.sk_tsflags;
> -       if (msg->msg_controllen) {
> -               err = sock_cmsg_send(&po->sk, msg, &sockc);
> -               if (unlikely(err))
> -                       goto out;
> -       }
> -
>         err = -ENXIO;
>         if (unlikely(dev == NULL))
>                 goto out;
> @@ -2672,6 +2665,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
>         if (unlikely(!(dev->flags & IFF_UP)))
>                 goto out_put;
>
> +       sockc.tsflags = po->sk.sk_tsflags;
> +       if (msg->msg_controllen) {
> +               err = sock_cmsg_send(&po->sk, msg, &sockc);
> +               if (unlikely(err))
> +                       goto out_put;
> +       }
> +
>         if (po->sk.sk_socket->type == SOCK_RAW)
>                 reserve = dev->hard_header_len;
>         size_max = po->tx_ring.frame_size
> --
> 2.12.2
>

Thank you, for the fix.
David Miller May 15, 2017, 6:25 p.m.
From: Douglas Caetano dos Santos <douglascs@taghos.com.br>
Date: Fri, 12 May 2017 15:19:15 -0300

> When using a TX ring buffer, if an error occurs processing a control
> message (e.g. invalid message), the net_device reference is not
> released.
> 
> Fixes c14ac9451c348 ("sock: enable timestamping using control messages")
> Signed-off-by: Douglas Caetano dos Santos <douglascs@taghos.com.br>

Applied and queued up for -stable, thanks.

Patch hide | download patch | download mbox

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f4001763134d..e3eeed19cc7a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2658,13 +2658,6 @@  static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 		dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
 	}
 
-	sockc.tsflags = po->sk.sk_tsflags;
-	if (msg->msg_controllen) {
-		err = sock_cmsg_send(&po->sk, msg, &sockc);
-		if (unlikely(err))
-			goto out;
-	}
-
 	err = -ENXIO;
 	if (unlikely(dev == NULL))
 		goto out;
@@ -2672,6 +2665,13 @@  static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 	if (unlikely(!(dev->flags & IFF_UP)))
 		goto out_put;
 
+	sockc.tsflags = po->sk.sk_tsflags;
+	if (msg->msg_controllen) {
+		err = sock_cmsg_send(&po->sk, msg, &sockc);
+		if (unlikely(err))
+			goto out_put;
+	}
+
 	if (po->sk.sk_socket->type == SOCK_RAW)
 		reserve = dev->hard_header_len;
 	size_max = po->tx_ring.frame_size