https://github.com/torvalds/linux
Revision 84ac7260236a49c79eede91617700174c2c19b0c authored by Philip Pettersson on 30 November 2016, 22:55:36 UTC, committed by David S. Miller on 02 December 2016, 17:16:49 UTC
When packet_set_ring creates a ring buffer it will initialize a struct timer_list if the packet version is TPACKET_V3. This value can then be raced by a different thread calling setsockopt to set the version to TPACKET_V1 before packet_set_ring has finished. This leads to a use-after-free on a function pointer in the struct timer_list when the socket is closed as the previously initialized timer will not be deleted. The bug is fixed by taking lock_sock(sk) in packet_setsockopt when changing the packet version while also taking the lock at the start of packet_set_ring. Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 2219d5e
Tip revision: 84ac7260236a49c79eede91617700174c2c19b0c authored by Philip Pettersson on 30 November 2016, 22:55:36 UTC
packet: fix race condition in packet_set_ring
packet: fix race condition in packet_set_ring
Tip revision: 84ac726
File | Mode | Size |
---|---|---|
Documentation | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
firmware | ||
fs | ||
include | ||
init | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.cocciconfig | -rw-r--r-- | 59 bytes |
.get_maintainer.ignore | -rw-r--r-- | 31 bytes |
.gitattributes | -rw-r--r-- | 30 bytes |
.gitignore | -rw-r--r-- | 1.3 KB |
.mailmap | -rw-r--r-- | 7.5 KB |
COPYING | -rw-r--r-- | 18.3 KB |
CREDITS | -rw-r--r-- | 96.0 KB |
Kbuild | -rw-r--r-- | 2.8 KB |
Kconfig | -rw-r--r-- | 252 bytes |
MAINTAINERS | -rw-r--r-- | 373.8 KB |
Makefile | -rw-r--r-- | 57.5 KB |
README | -rw-r--r-- | 17.9 KB |
REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
Computing file changes ...