diff options
author | Martin KaFai Lau <kafai@fb.com> | 2019-09-27 16:00:31 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-07 18:58:19 +0200 |
commit | 50b26ba8938f1741523ca733aa9a548a12b6edd6 (patch) | |
tree | 9aecf36629301bbdfe33ef1994b2b34113dd3f1c /net/nfc | |
parent | 4e71bbe0fdc87c33c15053ccca27ac8917126e2c (diff) | |
download | linux-stable-50b26ba8938f1741523ca733aa9a548a12b6edd6.tar.gz linux-stable-50b26ba8938f1741523ca733aa9a548a12b6edd6.tar.bz2 linux-stable-50b26ba8938f1741523ca733aa9a548a12b6edd6.zip |
net: Unpublish sk from sk_reuseport_cb before call_rcu
[ Upstream commit 8c7138b33e5c690c308b2a7085f6313fdcb3f616 ]
The "reuse->sock[]" array is shared by multiple sockets. The going away
sk must unpublish itself from "reuse->sock[]" before making call_rcu()
call. However, this unpublish-action is currently done after a grace
period and it may cause use-after-free.
The fix is to move reuseport_detach_sock() to sk_destruct().
Due to the above reason, any socket with sk_reuseport_cb has
to go through the rcu grace period before freeing it.
It is a rather old bug (~3 yrs). The Fixes tag is not necessary
the right commit but it is the one that introduced the SOCK_RCU_FREE
logic and this fix is depending on it.
Fixes: a4298e4522d6 ("net: add SOCK_RCU_FREE socket flag")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/nfc')
0 files changed, 0 insertions, 0 deletions