mirror of
https://github.com/followmsi/android_kernel_google_msm.git
synced 2024-09-21 04:00:29 +00:00
d5127daf88
[ Upstream commit 45f6fad84cc305103b28d73482b344d7f5b76f39 ] This patch addresses multiple problems : UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions while socket is not locked : Other threads can change np->opt concurrently. Dmitry posted a syzkaller (http://github.com/google/syzkaller) program desmonstrating use-after-free. Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock() and dccp_v6_request_recv_sock() also need to use RCU protection to dereference np->opt once (before calling ipv6_dup_options()) This patch adds full RCU protection to np->opt BUG: 28746669 Change-Id: I207da29ac48bb6dd7c40d65f9e27c4e3ff508da0 Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Pierre Imai <imaipi@google.com> |
||
|---|---|---|
| .. | ||
| ccids | ||
| ackvec.c | ||
| ackvec.h | ||
| ccid.c | ||
| ccid.h | ||
| dccp.h | ||
| diag.c | ||
| feat.c | ||
| feat.h | ||
| input.c | ||
| ipv4.c | ||
| ipv6.c | ||
| ipv6.h | ||
| Kconfig | ||
| Makefile | ||
| minisocks.c | ||
| options.c | ||
| output.c | ||
| probe.c | ||
| proto.c | ||
| qpolicy.c | ||
| sysctl.c | ||
| timer.c | ||