diff options
author | Eric Dumazet <edumazet@google.com> | 2015-11-29 19:37:57 -0800 |
---|---|---|
committer | Jiri Slaby <jslaby@suse.cz> | 2016-01-05 16:11:14 +0100 |
commit | 71781d1f85bc02bcdb29b18e9e76f1d49118ddc8 (patch) | |
tree | a65443d65688c5e6258b4fe084becf9951ec1e2f /net/core | |
parent | eac843e433fe2b8c25b55a0cf4294b12f05742e9 (diff) |
ipv6: add complete rcu protection around np->opt
[ Upstream commit 45f6fad84cc305103b28d73482b344d7f5b76f39 ]
This patch addresses multiple problems :
UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions
while socket is not locked : Other threads can change np->opt
concurrently. Dmitry posted a syzkaller
(http://github.com/google/syzkaller) program desmonstrating
use-after-free.
Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()
and dccp_v6_request_recv_sock() also need to use RCU protection
to dereference np->opt once (before calling ipv6_dup_options())
This patch adds full RCU protection to np->opt
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'net/core')
0 files changed, 0 insertions, 0 deletions