Re: [PATCH] ping: Fix race in free in receive path

On Fri, 2015-01-23 at 22:26 +0000, subashab@codeaurora.org wrote:

An exception is seen in ICMP ping receive path where the skb
destructor sock_rfree() tries to access a freed socket. This happens
because ping_rcv() releases socket reference with sock_put() and this
internally frees up the socket. Later icmp_rcv() will try to free the
skb and as part of this, skb destructor is called and which leads
to a kernel panic as the socket is freed already in ping_rcv().

...

Signed-off-by: Subash Abhinov Kasiviswanathan <redacted>
Cc: Eric Dumazet <edumazet@google.com>
---

Thanks !

Signed-off-by: Eric Dumazet <edumazet@google.com>