tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.

skb_splice_bits temporary drops the socket lock while iterating over
the socket queue in order to break a reverse locking condition which
happens with sendfile. This, however, opens a window of opportunity
for tcp_collapse() to aggregate skbs and thus potentially free the
current skb used in skb_splice_bits and tcp_read_sock.

This patch fixes the problem by (re-)getting the same "logical skb"
after the lock has been temporary dropped.

Based on idea and initial patch from Evgeniy Polyakov.

Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 2 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5c459f2b798..1e556d31211 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1445,6 +1445,7 @@ done:
 
         if (spd.nr_pages) {
                 int ret;
+                struct sock *sk = __skb->sk;
 
                 /*
                  * Drop the socket lock, otherwise we have reverse
@@ -1455,9 +1456,9 @@ done:
                  * we call into ->sendpage() with the i_mutex lock held
                  * and networking will grab the socket lock.
                  */
-                release_sock(__skb->sk);
+                release_sock(sk);
                 ret = splice_to_pipe(pipe, &spd);
-                lock_sock(__skb->sk);
+                lock_sock(sk);
                 return ret;
         }