From: Eric Dumazet <eric.duma...@gmail.com> Date: Sun, 29 Nov 2015 19:37:57 -0800
> From: Eric Dumazet <eduma...@google.com> > > This patch addresses multiple problems : > > UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions > while socket is not locked : Other threads can change np->opt > concurrently. Dmitry posted a syzkaller > (http://github.com/google/syzkaller) program desmonstrating > use-after-free. > > Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock() > and dccp_v6_request_recv_sock() also need to use RCU protection > to dereference np->opt once (before calling ipv6_dup_options()) > > This patch adds full RCU protection to np->opt > > Reported-by: Dmitry Vyukov <dvyu...@google.com> > Signed-off-by: Eric Dumazet <eduma...@google.com> Applied and queued up for -stable. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
