Commit b7761b0c authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Sasha Levin

packet: fix tp_reserve race in packet_set_ring

[ Upstream commit c27927e3 ]

Updates to tp_reserve can race with reads of the field in
packet_set_ring. Avoid this by holding the socket lock during
updates in setsockopt PACKET_RESERVE.

This bug was discovered by syzkaller.

Fixes: 8913336a ("packet: add PACKET_RESERVE sockopt")
Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 01deb691
...@@ -3370,14 +3370,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv ...@@ -3370,14 +3370,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
if (optlen != sizeof(val)) if (optlen != sizeof(val))
return -EINVAL; return -EINVAL;
if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
return -EBUSY;
if (copy_from_user(&val, optval, sizeof(val))) if (copy_from_user(&val, optval, sizeof(val)))
return -EFAULT; return -EFAULT;
if (val > INT_MAX) if (val > INT_MAX)
return -EINVAL; return -EINVAL;
po->tp_reserve = val; lock_sock(sk);
return 0; if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
ret = -EBUSY;
} else {
po->tp_reserve = val;
ret = 0;
}
release_sock(sk);
return ret;
} }
case PACKET_LOSS: case PACKET_LOSS:
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment