Messages in this thread | | | Date | Wed, 02 Dec 2015 23:38:21 -0500 (EST) | Subject | Re: [PATCH net] ipv6: add complete rcu protection around np->opt | From | David Miller <> |
| |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Sun, 29 Nov 2015 19:37:57 -0800
> From: Eric Dumazet <edumazet@google.com> > > This patch addresses multiple problems : > > UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions > while socket is not locked : Other threads can change np->opt > concurrently. Dmitry posted a syzkaller > (http://github.com/google/syzkaller) program desmonstrating > use-after-free. > > Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock() > and dccp_v6_request_recv_sock() also need to use RCU protection > to dereference np->opt once (before calling ipv6_dup_options()) > > This patch adds full RCU protection to np->opt > > Reported-by: Dmitry Vyukov <dvyukov@google.com> > Signed-off-by: Eric Dumazet <edumazet@google.com>
Applied and queued up for -stable.
| |