Re: [PATCH 8/14] [TIPC] Fix socket receive queue NULL pointer dereference on SMP systems
From: David Miller <davem@davemloft.net>
Date: 2006-10-17 04:55:28
From: David Miller <davem@davemloft.net>
Date: 2006-10-17 04:55:28
From: Per Liden <redacted> Date: Fri, 13 Oct 2006 13:37:49 +0200
From: P Litov <redacted> This patch corrects an SMP system-specific race condition which allowed TIPC to prematurely dereference the first sk_buff in a socket receive queue that was changing from empty to non-empty state. Signed-off-by: Allan Stephens <redacted> Signed-off-by: Per Liden <redacted>
If you are going to access the socket packet without some other kind of locking that prevents changes to the queue, you must take the skb queue lock. You can't dance around it by checking the linked list pointer instead the queue length. Otherwise we'd be doing this all over the UDP code and other datagram socket layers. And we don't because it simply isn't valid. So I'm not applying this. Also, this patch is missing a proper signed off line from the patch author, P Litov.