lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 02 Jun 2019 18:11:29 -0700 (PDT) From: David Miller <davem@...emloft.net> To: willemdebruijn.kernel@...il.com Cc: netdev@...r.kernel.org, willemb@...gle.com, syzkaller@...glegroups.com, dvyukov@...gle.com Subject: Re: [PATCH net] packet: unconditionally free po->rollover From: Willem de Bruijn <willemdebruijn.kernel@...il.com> Date: Fri, 31 May 2019 12:37:23 -0400 > From: Willem de Bruijn <willemb@...gle.com> > > Rollover used to use a complex RCU mechanism for assignment, which had > a race condition. The below patch fixed the bug and greatly simplified > the logic. > > The feature depends on fanout, but the state is private to the socket. > Fanout_release returns f only when the last member leaves and the > fanout struct is to be freed. > > Destroy rollover unconditionally, regardless of fanout state. > > Fixes: 57f015f5eccf2 ("packet: fix crash in fanout_demux_rollover()") > Reported-by: syzbot <syzkaller@...glegroups.com> > Diagnosed-by: Dmitry Vyukov <dvyukov@...gle.com> > Signed-off-by: Willem de Bruijn <willemb@...gle.com> Applied and queued up for -stable.
Powered by blists - more mailing lists