| commit | 5ed555a986ca2c52a6ebcb9876f8daf38f745f34 | [log] [tgz] |
|---|---|---|
| author | Willem de Bruijn <[email protected]> | Wed Dec 15 09:39:37 2021 -0500 |
| committer | Robert Kolchmeyer <[email protected]> | Mon Jan 10 22:36:11 2022 +0000 |
| tree | aeb7e00a71d062a769c92234f19d74c708384bc6 | |
| parent | c074770a6656e3c882367954354c2cdb08b6b59e [diff] |
net/packet: rx_owner_map depends on pg_vec
[ Upstream commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 ]
Packet sockets may switch ring versions. Avoid misinterpreting state
between versions, whose fields share a union. rx_owner_map is only
allocated with a packet ring (pg_vec) and both are swapped together.
If pg_vec is NULL, meaning no packet ring was allocated, then neither
was rx_owner_map. And the field may be old state from a tpacket_v3.
Fixes: 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition")
Reported-by: Syzbot <[email protected]>
Signed-off-by: Willem de Bruijn <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
(cherry picked from commit 027a13973dadb64ef4f19db56c9b619ee82c3375)
Signed-off-by: Robert Kolchmeyer <[email protected]>
BUG=b/213408300,b/213920435
TEST=presubmit
RELEASE_NOTE=Fixed a double-free issue in packet_set_ring in the Linux kernel.
cos-patch: bug
Change-Id: Ida77996f5bcbdf5441eb3bf8b15a9025809f2d35
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/27261
Reviewed-by: Vaibhav Rustagi <[email protected]>
Reviewed-by: Oleksandr Tymoshenko <[email protected]>
Tested-by: Cusky Presubmit Bot <[email protected]>