From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752036AbbLNCob (ORCPT <rfc822;w@1wt.eu>);
	Sun, 13 Dec 2015 21:44:31 -0500
Received: from ozlabs.org ([103.22.144.67]:37060 "EHLO ozlabs.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751624AbbLNCoa (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Sun, 13 Dec 2015 21:44:30 -0500
Date: Mon, 14 Dec 2015 13:44:26 +1100
From: Paul Mackerras <paulus@ozlabs.org>
To: Sasha Levin <sasha.levin@oracle.com>, linux-kernel@vger.kernel.org
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>, stable@vger.kernel.org
Subject: Bad backport of "net: Fix skb_set_peeked use-after-free bug" in
 3.18.23
Message-ID: <20151214024426.GA23275@iris.ozlabs.ibm.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.24 (2015-08-30)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Commit d9a1133495b4 ("net: Fix skb_set_peeked use-after-free bug") in
3.18.23 claims to be a backport of commit a0a2a6602496, but in fact
the patch is identical to commit 738ac1ebb96d ("net: Clone skb before
setting peeked flag"), which is the commit that introduces the
use-after-free bug that a0a2a6602496 fixes.

The result is that we have been seeing crashes in __skb_recv_datagram
since I merged v3.18.24 into the kernel code we are using for a
product.  Could someone fix this with an actual backport of
a0a2a6602496 please?

Thanks,
Paul.