| commit | 957c2ec5c7b906973b8bf5be3dd066524569b1ec | [log] [tgz] |
|---|---|---|
| author | Willem de Bruijn <[email protected]> | Thu Aug 10 16:41:58 2017 |
| committer | ChromeOS Commit Bot <[email protected]> | Wed Nov 08 22:49:53 2017 |
| tree | ec242289bd0439a2152f5cf32269df04dd0094ef | |
| parent | 5e02a24a574ecbd1f39fe370475c399e1f93d131 [diff] |
UPSTREAM: packet: fix tp_reserve race in packet_set_ring
[ Upstream commit c27927e372f0785f3303e8fad94b85945e2c97b7 ]
Updates to tp_reserve can race with reads of the field in
packet_set_ring. Avoid this by holding the socket lock during
updates in setsockopt PACKET_RESERVE.
This bug was discovered by syzkaller.
BUG=chromium:780782
TEST=trybot
Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt")
Reported-by: Andrey Konovalov <[email protected]>
Signed-off-by: Willem de Bruijn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit 63364a508d24944abb0975bd823cb11367c56283)
Signed-off-by: Daniel Wang <[email protected]>
Change-Id: I427f6c69ac1a57859be921bd3914a62de29ed7f4
Reviewed-on: https://chromium-review.googlesource.com/759137
Tested-by: Daniel Wang <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Commit-Queue: Daniel Wang <[email protected]>