From: Eric Dumazet <>
Date: Sun, 15 Apr 2018 17:52:04 -0700

> In order to remove the race caught by syzbot [1], we need
> to lock the socket before using po->tp_version as this could
> change under us otherwise.
> This means lock_sock() and release_sock() must be done by
> packet_set_ring() callers.
> Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
> Signed-off-by: Eric Dumazet <>
> Reported-by: syzbot <>

The locking in AF_PACKET is very unkind, as has been discussed
before.  Good thing syzbot found this one.

The only other place we access po->tp_version asynchronously
is in the getsockopt() for statistics, and I guess that case
is OK.

Applied and queued up for -stable, thanks Eric.

Reply via email to