packet: fix races in fanout_add() 01/155201/1
authorEric Dumazet <edumazet@google.com>
Tue, 14 Feb 2017 17:03:51 +0000 (09:03 -0800)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Thu, 12 Oct 2017 09:21:04 +0000 (18:21 +0900)
commitf0295c3fe30d58888c555314e803e352903894b5
treebb8212da5c8f0d29fd2a43b9388948d1a4ac7a1d
parent83758e7327109309ae5a71c33e10efdb56aee856
packet: fix races in fanout_add()

commit d199fab63c11998a602205f7ee7ff7c05c97164b upstream.

Multiple threads can call fanout_add() at the same time.

We need to grab fanout_mutex earlier to avoid races that could
lead to one thread freeing po->rollover that was set by another thread.

Do the same in fanout_release(), for peace of mind, and to help us
finding lockdep issues earlier.

[js] no rollover in 3.12

Fixes: dc99f600698d ("packet: Add fanout support.")
Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Willy Tarreau <w@1wt.eu>
[sw0312.kim: cherry-pick from linux-3.10.y to fix CVE-2017-6346]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: Ia81bda1ccaf66462fea305c918353b0d34f63e71
net/packet/af_packet.c