packet: avoid panic in packet_getsockopt()
authorEric Dumazet <edumazet@google.com>
Wed, 18 Oct 2017 23:14:52 +0000 (16:14 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 18 Nov 2017 10:30:36 +0000 (11:30 +0100)
commite186faf27b12f5466e060a5f3ea1a667f1b5bd04
tree8d5d856b57531c5f34fb7947cf62227656c56e25
parentd11a508f627abf7beac5bc680cb620cb0e94d200
packet: avoid panic in packet_getsockopt()

[ Upstream commit 509c7a1ecc8601f94ffba8a00889fefb239c00c6 ]

syzkaller got crashes in packet_getsockopt() processing
PACKET_ROLLOVER_STATS command while another thread was managing
to change po->rollover

Using RCU will fix this bug. We might later add proper RCU annotations
for sparse sake.

In v2: I replaced kfree(rollover) in fanout_add() to kfree_rcu()
variant, as spotted by John.

Fixes: a9b6391814d5 ("packet: rollover statistics")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: John Sperbeck <jsperbeck@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/packet/af_packet.c