diff options
| author | Frank Blaschka <frank.blaschka@de.ibm.com> | 2008-03-03 12:16:04 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-03-03 12:16:04 -0800 |
| commit | 7e36763b2c204d59de4e88087f84a2c0c8421f25 (patch) | |
| tree | 5e39fcd1121fd033bd1ff985aa37de017f933526 /net/core/neighbour.c | |
| parent | c3d84a4dd22c727f5ed64453c72183c242ac9c19 (diff) | |
[NET]: Fix race in generic address resolution.
neigh_update sends skb from neigh->arp_queue while neigh_timer_handler
has increased skbs refcount and calls solicit with the
skb. neigh_timer_handler should not increase skbs refcount but make a
copy of the skb and do solicit with the copy.
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/neighbour.c')
| -rw-r--r-- | net/core/neighbour.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/neighbour.c b/net/core/neighbour.c index aef01533dfb..d9a02b2cc28 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -839,7 +839,7 @@ static void neigh_timer_handler(unsigned long arg) struct sk_buff *skb = skb_peek(&neigh->arp_queue); /* keep skb alive even if arp_queue overflows */ if (skb) - skb_get(skb); + skb = skb_copy(skb, GFP_ATOMIC); write_unlock(&neigh->lock); neigh->ops->solicit(neigh, skb); atomic_inc(&neigh->probes); |