path: root/net/unix
diff options
authorHannes Frederic Sowa <>2015-11-16 16:25:56 +0100
committerDavid S. Miller <>2015-11-16 15:39:35 -0500
commit8844f97238ca6c1ca92a5d6c69f53efd361a266f (patch)
treeae78e41bca38aa8c0b35fa0065ed117516df2418 /net/unix
parent24cb7055a3066634a0f3fa0cd6a4780652905d35 (diff)
af_unix: don't append consumed skbs to sk_receive_queue
In case multiple writes to a unix stream socket race we could end up in a situation where we pre-allocate a new skb for use in unix_stream_sendpage but have to free it again in the locked section because another skb has been appended meanwhile, which we must use. Accidentally we didn't clear the pointer after consuming it and so we touched freed memory while appending it to the sk_receive_queue. So, clear the pointer after consuming the skb. This bug has been found with syzkaller ( by Dmitry Vyukov. Fixes: 869e7c62486e ("net: af_unix: implement stream sendpage support") Reported-by: Dmitry Vyukov <> Cc: Dmitry Vyukov <> Cc: Eric Dumazet <> Signed-off-by: Hannes Frederic Sowa <> Acked-by: Eric Dumazet <> Signed-off-by: David S. Miller <>
Diffstat (limited to 'net/unix')
1 files changed, 1 insertions, 0 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 12b886f07982..a8352db5c5b5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1800,6 +1800,7 @@ alloc_skb:
* this - does no harm
+ newskb = NULL;
if (skb_append_pagefrags(skb, page, offset, size)) {