From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753456AbbK2WIO (ORCPT ); Sun, 29 Nov 2015 17:08:14 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:56738 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752946AbbK2WIJ (ORCPT ); Sun, 29 Nov 2015 17:08:09 -0500 Message-Id: <20151129214703.897342051@1wt.eu> User-Agent: quilt/0.63-1 Date: Sun, 29 Nov 2015 22:47:26 +0100 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Herbert Xu , Eric Dumazet , "David S. Miller" , Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 24/38] [PATCH 24/38] net: Fix skb csum races when peeking MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <8acf8256ccc72771a80b7851061027bc@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 89c22d8c3b278212eef6a8cc66b570bc840a6f5a ] When we calculate the checksum on the recv path, we store the result in the skb as an optimisation in case we need the checksum again down the line. This is in fact bogus for the MSG_PEEK case as this is done without any locking. So multiple threads can peek and then store the result to the same skb, potentially resulting in bogus skb states. This patch fixes this by only storing the result if the skb is not shared. This preserves the optimisations for the few cases where it can be done safely due to locking or other reasons, e.g., SIOCINQ. Signed-off-by: Herbert Xu Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings (cherry picked from commit 58a5897a53d535bf95523e6f381f88116217f5ca) Signed-off-by: Willy Tarreau --- net/core/datagram.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/datagram.c b/net/core/datagram.c index c855336..253d068 100644 --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -675,7 +675,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) if (likely(!sum)) { if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) netdev_rx_csum_fault(skb->dev); - skb->ip_summed = CHECKSUM_UNNECESSARY; + if (!skb_shared(skb)) + skb->ip_summed = CHECKSUM_UNNECESSARY; } return sum; } -- 1.7.12.2.21.g234cd45.dirty