From 1037d951b9f7c1efc17ec94476e922e1b82e7600 Mon Sep 17 00:00:00 2001 From: Willem de Bruijn Date: Wed, 12 Jun 2019 10:45:28 +0800 Subject: [PATCH] packet: unconditionally free po->rollover [ Upstream commit afa0925c6fcc6a8f610e996ca09bc3215048033c ] Rollover used to use a complex RCU mechanism for assignment, which had a race condition. The below patch fixed the bug and greatly simplified the logic. The feature depends on fanout, but the state is private to the socket. Fanout_release returns f only when the last member leaves and the fanout struct is to be freed. Destroy rollover unconditionally, regardless of fanout state. Fixes: 57f015f5eccf2 ("packet: fix crash in fanout_demux_rollover()") Reported-by: syzbot Diagnosed-by: Dmitry Vyukov Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Yang Yingliang --- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 61180905c2fc..887ca9e4e3b4 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3017,8 +3017,8 @@ static int packet_release(struct socket *sock) synchronize_net(); + kfree(po->rollover); if (f) { - kfree(po->rollover); fanout_release_data(f); kfree(f); } -- GitLab