From: Eric Dumazet <eric.duma...@gmail.com>
Date: Tue, 22 Aug 2017 09:39:28 -0700
> From: Eric Dumazet <eduma...@google.com>
>
> When peeking, if a bad csum is discovered, the skb is unlinked from
> the queue with __sk_queue_drop_skb and the peek operation restarted.
>
> __sk_queue_drop_skb only drops packets that match the queue head.
>
> This fails if the skb was found after the head, using SO_PEEK_OFF
> socket option. This causes an infinite loop.
>
> We MUST drop this problematic skb, and we can simply check if skb was
> already removed by another thread, by looking at skb->next :
>
> This pointer is set to NULL by the __skb_unlink() operation, that might
> have happened only under the spinlock protection.
>
> Many thanks to syzkaller team (and particularly Dmitry Vyukov who
> provided us nice C reproducers exhibiting the lockup) and Willem de
> Bruijn who provided first version for this patch and a test program.
>
> Fixes: 627d2d6b5500 ("udp: enable MSG_PEEK at non-zero offset")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: Dmitry Vyukov <dvyu...@google.com>
Applied and queued up for -stable.
