[NETLINK]: Fix sk_rmem_alloc assertion failure in af_netlink.c

ChangeSet 1.1493, 2005/03/31 11:14:08-08:00, [email protected]

	[NETLINK]: Fix sk_rmem_alloc assertion failure in af_netlink.c
	
	In netlink_dump we're operating on sk after dropping the cb lock.
	This is racy because the owner of the socket could close it after
	we drop the cb lock.
	
	This is possible because netlink_dump isn't always called from the
	context of the process that owns the socket.  For instance, if there
	is contention on rtnl then rtnetlink requests will be processed by
	the process that owns the rtnl.
	
	The solution is to hold a ref count on the socket before we drop
	the cb lock.
	
	Signed-off-by: Herbert Xu <[email protected]>
	Signed-off-by: David S. Miller <[email protected]>



 af_netlink.c |    2 ++
 1 files changed, 2 insertions(+)


diff -Nru a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
--- a/net/netlink/af_netlink.c	2005-04-05 13:02:52 -07:00
+++ b/net/netlink/af_netlink.c	2005-04-05 13:02:52 -07:00
@@ -980,9 +980,11 @@
 	len = cb->dump(skb, cb);
 
 	if (len > 0) {
+		sock_hold(sk);
 		spin_unlock(&sk->protinfo.af_netlink->cb_lock);
 		skb_queue_tail(&sk->receive_queue, skb);
 		sk->data_ready(sk, len);
+		sock_put(sk);
 		return 0;
 	}