netlink: Fix dump skb leak/double free
authorHerbert Xu <herbert@gondor.apana.org.au>
Mon, 16 May 2016 09:28:16 +0000 (17:28 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 24 Jun 2016 17:18:16 +0000 (10:18 -0700)
commit49543942beb1b9ca95709d6cfa67708932aa4d11
treecd5082f583d89270ba113731a72d918b6e2e9bb9
parent23cdd8c3cbe9d790f23d7f9ae14e9b828f56f69c
netlink: Fix dump skb leak/double free

[ Upstream commit 92964c79b357efd980812c4de5c1fd2ec8bb5520 ]

When we free cb->skb after a dump, we do it after releasing the
lock.  This means that a new dump could have started in the time
being and we'll end up freeing their skb instead of ours.

This patch saves the skb and module before we unlock so we free
the right memory.

Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
Reported-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netlink/af_netlink.c