Willem de Bruijn 008ba2a13f packet: hold bind lock when rebinding to fanout hook ... Packet socket bind operations must hold the po->bind_lock. This keeps po->running consistent with whether the socket is actually on a ptype list to receive packets. fanout_add unbinds a socket and its packet_rcv/tpacket_rcv call, then binds the fanout object to receive through packet_rcv_fanout. Make it hold the po->bind_lock when testing po->running and rebinding. Else, it can race with other rebind operations, such as that in packet_set_ring from packet_rcv to tpacket_rcv. Concurrent updates can result in a socket being added to a fanout group twice, causing use-after-free KASAN bug reports, among others. Reported independently by both trinity and syzkaller. Verified that the syzkaller reproducer passes after this patch. Fixes: dc99f60069 ("packet: Add fanout support.") Reported-by: nixioaming <nixiaoming@huawei.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-09-20 13:57:19 -07:00
..
af_packet.c	packet: hold bind lock when rebinding to fanout hook	2017-09-20 13:57:19 -07:00
diag.c	packet: pdiag_put_ring() should return TX_RING info for TPACKET_V3	2017-01-10 21:02:42 -05:00
internal.h	net: convert packet_fanout.sk_ref from atomic_t to refcount_t	2017-07-01 07:39:09 -07:00
Kconfig	packet: Diag core and basic socket info dumping	2012-08-14 16:56:33 -07:00
Makefile	packet: Diag core and basic socket info dumping	2012-08-14 16:56:33 -07:00