path: root/kernel
diff options
authorWillem de Bruijn <willemb@google.com>2017-09-14 17:14:41 -0400
committerDavid S. Miller <davem@davemloft.net>2017-09-20 13:57:19 -0700
commit008ba2a13f2d04c947adc536d19debb8fe66f110 (patch)
treee6d5a2faacf4925192f0197f6cf60c5640a1cfaa /kernel
parent35e015e1f5773417952fe91ce8790baf9b4237a2 (diff)
packet: hold bind lock when rebinding to fanout hook
Packet socket bind operations must hold the po->bind_lock. This keeps po->running consistent with whether the socket is actually on a ptype list to receive packets. fanout_add unbinds a socket and its packet_rcv/tpacket_rcv call, then binds the fanout object to receive through packet_rcv_fanout. Make it hold the po->bind_lock when testing po->running and rebinding. Else, it can race with other rebind operations, such as that in packet_set_ring from packet_rcv to tpacket_rcv. Concurrent updates can result in a socket being added to a fanout group twice, causing use-after-free KASAN bug reports, among others. Reported independently by both trinity and syzkaller. Verified that the syzkaller reproducer passes after this patch. Fixes: dc99f600698d ("packet: Add fanout support.") Reported-by: nixioaming <nixiaoming@huawei.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions