aboutsummaryrefslogtreecommitdiff
path: root/net/core/neighbour.c
diff options
context:
space:
mode:
authorFrank Blaschka <frank.blaschka@de.ibm.com>2008-03-03 12:16:04 -0800
committerDavid S. Miller <davem@davemloft.net>2008-03-03 12:16:04 -0800
commit7e36763b2c204d59de4e88087f84a2c0c8421f25 (patch)
tree5e39fcd1121fd033bd1ff985aa37de017f933526 /net/core/neighbour.c
parentc3d84a4dd22c727f5ed64453c72183c242ac9c19 (diff)
[NET]: Fix race in generic address resolution.
neigh_update sends skb from neigh->arp_queue while neigh_timer_handler has increased skbs refcount and calls solicit with the skb. neigh_timer_handler should not increase skbs refcount but make a copy of the skb and do solicit with the copy. Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/neighbour.c')
-rw-r--r--net/core/neighbour.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index aef01533dfb..d9a02b2cc28 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -839,7 +839,7 @@ static void neigh_timer_handler(unsigned long arg)
struct sk_buff *skb = skb_peek(&neigh->arp_queue);
/* keep skb alive even if arp_queue overflows */
if (skb)
- skb_get(skb);
+ skb = skb_copy(skb, GFP_ATOMIC);
write_unlock(&neigh->lock);
neigh->ops->solicit(neigh, skb);
atomic_inc(&neigh->probes);