From: Willem de Bruijn <willemdebruijn.ker...@gmail.com>
Date: Fri, 31 May 2019 12:37:23 -0400
> From: Willem de Bruijn <will...@google.com>
>
> Rollover used to use a complex RCU mechanism for assignment, which had
> a race condition. The below patch fixed the bug and greatly simplified
> the logic.
>
> The feature depends on fanout, but the state is private to the socket.
> Fanout_release returns f only when the last member leaves and the
> fanout struct is to be freed.
>
> Destroy rollover unconditionally, regardless of fanout state.
>
> Fixes: 57f015f5eccf2 ("packet: fix crash in fanout_demux_rollover()")
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Diagnosed-by: Dmitry Vyukov <dvyu...@google.com>
> Signed-off-by: Willem de Bruijn <will...@google.com>
Applied and queued up for -stable.
