From afa0925c6fcc6a8f610e996ca09bc3215048033c Mon Sep 17 00:00:00 2001 From: Willem de Bruijn Date: Fri, 31 May 2019 12:37:23 -0400 Subject: packet: unconditionally free po->rollover Rollover used to use a complex RCU mechanism for assignment, which had a race condition. The below patch fixed the bug and greatly simplified the logic. The feature depends on fanout, but the state is private to the socket. Fanout_release returns f only when the last member leaves and the fanout struct is to be freed. Destroy rollover unconditionally, regardless of fanout state. Fixes: 57f015f5eccf2 ("packet: fix crash in fanout_demux_rollover()") Reported-by: syzbot Diagnosed-by: Dmitry Vyukov Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller --- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net/packet') diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index fbc775fbf712..d4889bf7248e 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3014,8 +3014,8 @@ static int packet_release(struct socket *sock) synchronize_net(); + kfree(po->rollover); if (f) { - kfree(po->rollover); fanout_release_data(f); kfree(f); } -- cgit v1.2.3