Willem de Bruijn ff0eab26dc UPSTREAM: packet: hold bind lock when rebinding to fanout hook ... [ Upstream commit 008ba2a13f2d04c947adc536d19debb8fe66f110 ] Packet socket bind operations must hold the po->bind_lock. This keeps po->running consistent with whether the socket is actually on a ptype list to receive packets. fanout_add unbinds a socket and its packet_rcv/tpacket_rcv call, then binds the fanout object to receive through packet_rcv_fanout. Make it hold the po->bind_lock when testing po->running and rebinding. Else, it can race with other rebind operations, such as that in packet_set_ring from packet_rcv to tpacket_rcv. Concurrent updates can result in a socket being added to a fanout group twice, causing use-after-free KASAN bug reports, among others. Reported independently by both trinity and syzkaller. Verified that the syzkaller reproducer passes after this patch. Fixes: dc99f60069 ("packet: Add fanout support.") Change-Id: I6817d1f12654dd682a962cfd4645006a7315360d Reported-by: nixioaming <nixiaoming@huawei.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Marissa Wall <marissaw@google.com>		2018-05-26 00:39:35 +02:00
..
af_packet.c	UPSTREAM: packet: hold bind lock when rebinding to fanout hook	2018-05-26 00:39:35 +02:00
diag.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-06-26 15:12:37 -04:00
internal.h	packet: handle too big packets for PACKET_V3	2014-10-15 08:31:56 +02:00
Kconfig
Makefile