diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2017-06-02 11:23:08 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2017-06-02 11:23:08 -0400 |
| commit | e65f0246f0d1e4a300804fd0b003dcaa3ef4edeb (patch) | |
| tree | 380fd50b6d264c35702cd6b3792e0cfa77932a25 | |
| parent | a1810dce314351aa6cc20ba5456b6503333a9fba (diff) | |
| download | longterm-queue-4.8-e65f0246f0d1e4a300804fd0b003dcaa3ef4edeb.tar.gz | |
net: sock.c context refresh
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
| -rw-r--r-- | queue/socket-bpf-fix-sk_filter-use-after-free-in-sk_clone_.patch | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/queue/socket-bpf-fix-sk_filter-use-after-free-in-sk_clone_.patch b/queue/socket-bpf-fix-sk_filter-use-after-free-in-sk_clone_.patch index 5b685ff..e2e7e2b 100644 --- a/queue/socket-bpf-fix-sk_filter-use-after-free-in-sk_clone_.patch +++ b/queue/socket-bpf-fix-sk_filter-use-after-free-in-sk_clone_.patch @@ -1,4 +1,4 @@ -From a97e50cc4cb67e1e7bff56f6b41cda62ca832336 Mon Sep 17 00:00:00 2001 +From 409af9f9b0ce2ad89144e0a81782a1d8e1374c68 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann <daniel@iogearbox.net> Date: Wed, 22 Mar 2017 13:08:08 +0100 Subject: [PATCH] socket, bpf: fix sk_filter use after free in sk_clone_lock @@ -42,10 +42,10 @@ Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> diff --git a/net/core/sock.c b/net/core/sock.c -index acb0d4137499..2c4f574168fb 100644 +index 0cb67c14e2ba..e00db7983093 100644 --- a/net/core/sock.c +++ b/net/core/sock.c -@@ -1544,6 +1544,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) +@@ -1558,6 +1558,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) is_charged = sk_filter_charge(newsk, filter); if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { @@ -55,9 +55,9 @@ index acb0d4137499..2c4f574168fb 100644 + */ + if (!is_charged) + RCU_INIT_POINTER(newsk->sk_filter, NULL); - sk_free_unlock_clone(newsk); - newsk = NULL; - goto out; + /* It is still raw copy of parent, so invalidate + * destructor and make plain sk_free() */ + newsk->sk_destruct = NULL; -- 2.12.0 |