From: Eric Dumazet <[email protected]>
Date: Sun, 15 Apr 2018 17:52:04 -0700
> In order to remove the race caught by syzbot [1], we need
> to lock the socket before using po->tp_version as this could
> change under us otherwise.
>
> This means lock_sock() and release_sock() must be done by
> packet_set_ring() callers.
...
> Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
> Signed-off-by: Eric Dumazet <[email protected]>
> Reported-by: syzbot <[email protected]>
The locking in AF_PACKET is very unkind, as has been discussed
before. Good thing syzbot found this one.
The only other place we access po->tp_version asynchronously
is in the getsockopt() for statistics, and I guess that case
is OK.
Applied and queued up for -stable, thanks Eric.
