From: Eric Dumazet <eduma...@google.com> Date: Sun, 15 Apr 2018 17:52:04 -0700
> In order to remove the race caught by syzbot , we need > to lock the socket before using po->tp_version as this could > change under us otherwise. > > This means lock_sock() and release_sock() must be done by > packet_set_ring() callers. ... > Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: syzbot <syzkal...@googlegroups.com> The locking in AF_PACKET is very unkind, as has been discussed before. Good thing syzbot found this one. The only other place we access po->tp_version asynchronously is in the getsockopt() for statistics, and I guess that case is OK. Applied and queued up for -stable, thanks Eric.