Skip to main content

Browse the archive

Revision 64b4c411a6c7a5f27555bfc2d6310b87bde3db67 authored by Andrew Morton on 21 October 2022, 04:19:22 UTC, committed by Andrew Morton on 28 October 2022, 20:37:22 UTC 
ipc/msg.c: fix percpu_counter use after free
 
These percpu counters are referenced in free_ipcs->freeque, so destroy
them later.

Fixes: 72d1e611082e ("ipc/msg: mitigate the lock contention with percpu counter")
Reported-by: syzbot+96e659d35b9d6b541152@syzkaller.appspotmail.com
Tested-by: Mark Rutland <mark.rutland@arm.com>
Cc: Jiebin Sun <jiebin.sun@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1 parent 27d676a
Raw File
if_tun.h 
/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 *  Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com>
 */
#ifndef __IF_TUN_H
#define __IF_TUN_H

#include <uapi/linux/if_tun.h>
#include <uapi/linux/virtio_net.h>

#define TUN_XDP_FLAG 0x1UL

#define TUN_MSG_UBUF 1
#define TUN_MSG_PTR  2
struct tun_msg_ctl {
	unsigned short type;
	unsigned short num;
	void *ptr;
};

struct tun_xdp_hdr {
	int buflen;
	struct virtio_net_hdr gso;
};

#if defined(CONFIG_TUN) || defined(CONFIG_TUN_MODULE)
struct socket *tun_get_socket(struct file *);
struct ptr_ring *tun_get_tx_ring(struct file *file);
static inline bool tun_is_xdp_frame(void *ptr)
{
       return (unsigned long)ptr & TUN_XDP_FLAG;
}
static inline void *tun_xdp_to_ptr(struct xdp_frame *xdp)
{
       return (void *)((unsigned long)xdp | TUN_XDP_FLAG);
}
static inline struct xdp_frame *tun_ptr_to_xdp(void *ptr)
{
       return (void *)((unsigned long)ptr & ~TUN_XDP_FLAG);
}
void tun_ptr_free(void *ptr);
#else
#include <linux/err.h>
#include <linux/errno.h>
struct file;
struct socket;
static inline struct socket *tun_get_socket(struct file *f)
{
	return ERR_PTR(-EINVAL);
}
static inline struct ptr_ring *tun_get_tx_ring(struct file *f)
{
	return ERR_PTR(-EINVAL);
}
static inline bool tun_is_xdp_frame(void *ptr)
{
	return false;
}
static inline void *tun_xdp_to_ptr(struct xdp_frame *xdp)
{
	return NULL;
}
static inline struct xdp_frame *tun_ptr_to_xdp(void *ptr)
{
	return NULL;
}
static inline void tun_ptr_free(void *ptr)
{
}
#endif /* CONFIG_TUN */
#endif /* __IF_TUN_H */
back to top