Willem de Bruijn da096fe1a6 packet: unconditionally free po->rollover ...

[ Upstream commit afa0925c6f ]

Rollover used to use a complex RCU mechanism for assignment, which had
a race condition. The below patch fixed the bug and greatly simplified
the logic.

The feature depends on fanout, but the state is private to the socket.
Fanout_release returns f only when the last member leaves and the
fanout struct is to be freed.

Destroy rollover unconditionally, regardless of fanout state.

Fixes: 57f015f5ec ("packet: fix crash in fanout_demux_rollover()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Diagnosed-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-06-11 12:20:49 +02:00

..

af_packet.c

packet: unconditionally free po->rollover

2019-06-11 12:20:49 +02:00

diag.c

packet: pdiag_put_ring() should return TX_RING info for TPACKET_V3

2017-01-10 21:02:42 -05:00

internal.h

Revert "packet: switch kvzalloc to allocate memory"

2018-08-31 23:00:28 -07:00

Kconfig

packet: Diag core and basic socket info dumping

2012-08-14 16:56:33 -07:00

Makefile

packet: Diag core and basic socket info dumping

2012-08-14 16:56:33 -07:00