Commit c27927e3 authored Aug 10, 2017 by Willem de Bruijn Committed by David S. Miller Aug 10, 2017

packet: fix tp_reserve race in packet_set_ring



Updates to tp_reserve can race with reads of the field in
packet_set_ring. Avoid this by holding the socket lock during
updates in setsockopt PACKET_RESERVE.

This bug was discovered by syzkaller.

Fixes: 8913336a ("packet: add PACKET_RESERVE sockopt")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 85f1bd9a

net/packet/af_packet.c

+9 −4

Original line number	Diff line number	Diff line
		@@ -3700,14 +3700,19 @@ packet_setsockopt(struct socket sock, int level, int optname, char __user optv

		if (optlen != sizeof(val))
		return -EINVAL;
		if (po->rx_ring.pg_vec \|\| po->tx_ring.pg_vec)
		return -EBUSY;
		if (copy_from_user(&val, optval, sizeof(val)))
		return -EFAULT;
		if (val > INT_MAX)
		return -EINVAL;
		lock_sock(sk);
		if (po->rx_ring.pg_vec \|\| po->tx_ring.pg_vec) {
		ret = -EBUSY;
		} else {
		po->tp_reserve = val;
		return 0;
		ret = 0;
		}
		release_sock(sk);
		return ret;
		}
		case PACKET_LOSS:
		{