Skip to content

Commit 8b74d43

Browse files
Eric Dumazetdavem330
Eric Dumazet
authored andcommitted
net/llc: avoid BUG_ON() in skb_orphan()
It seems nobody used LLC since linux-3.12. Fortunately fuzzers like syzkaller still know how to run this code, otherwise it would be no fun. Setting skb->sk without skb->destructor leads to all kinds of bugs, we now prefer to be very strict about it. Ideally here we would use skb_set_owner() but this helper does not exist yet, only CAN seems to have a private helper for that. Fixes: 376c731 ("net: add a temporary sanity check in skb_orphan()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 7f67763 commit 8b74d43

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

Diff for: net/llc/llc_conn.c

+3
Original file line numberDiff line numberDiff line change
@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
821821
* another trick required to cope with how the PROCOM state
822822
* machine works. -acme
823823
*/
824+
skb_orphan(skb);
825+
sock_hold(sk);
824826
skb->sk = sk;
827+
skb->destructor = sock_efree;
825828
}
826829
if (!sock_owned_by_user(sk))
827830
llc_conn_rcv(sk, skb);

Diff for: net/llc/llc_sap.c

+3
Original file line numberDiff line numberDiff line change
@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
290290

291291
ev->type = LLC_SAP_EV_TYPE_PDU;
292292
ev->reason = 0;
293+
skb_orphan(skb);
294+
sock_hold(sk);
293295
skb->sk = sk;
296+
skb->destructor = sock_efree;
294297
llc_sap_state_process(sap, skb);
295298
}
296299

0 commit comments

Comments
 (0)