On Thu, Sep 14, 2017 at 5:14 PM, Willem de Bruijn <will...@google.com> wrote:
> Packet socket bind operations must hold the po->bind_lock. This keeps
> po->running consistent with whether the socket is actually on a ptype
> list to receive packets.
>
> fanout_add unbinds a socket and its packet_rcv/tpacket_rcv call, then
> binds the fanout object to receive through packet_rcv_fanout.
>
> Make it hold the po->bind_lock when testing po->running and rebinding.
> Else, it can race with other rebind operations, such as that in
> packet_set_ring from packet_rcv to tpacket_rcv. Concurrent updates
> can result in a socket being added to a fanout group twice, causing
> use-after-free KASAN bug reports, among others.
>
> Reported independently by both trinity and syzkaller.
> Verified that the syzkaller reproducer passes after this patch.
>
I forgot to add the Fixes tag, sorry.
Fixes: dc99f600698d ("packet: Add fanout support.")
> Reported-by: nixioaming <nixiaom...@huawei.com>
> Signed-off-by: Willem de Bruijn <will...@google.com>
