From: Willem de Bruijn <willemdebruijn.ker...@gmail.com>
Date: Sat, 24 Nov 2018 21:09:26 -0500
> From: Willem de Bruijn <will...@google.com>
>
> Packet sockets with PACKET_TX_RING send skbs with user data in frags.
>
> Before commit 5cd8d46ea156 ("packet: copy user buffers before orphan
> or clone") ring slots could be released prematurely, possibly allowing
> a process to overwrite data still in flight.
>
> This test opens two packet sockets, one to send and one to read.
> The sender has a tx ring of one slot. It sends two packets with
> different payload, then reads both and verifies their payload.
>
> Before the above commit, both receive calls return the same data as
> the send calls use the same buffer. From the commit, the clone
> needed for looping onto a packet socket triggers an skb_copy_ubufs
> to create a private copy. The separate sends each arrive correctly.
>
> Signed-off-by: Willem de Bruijn <will...@google.com>
Thanks for following up on this, applied.
