]> Git Repo - linux.git/commit
socket, bpf: fix possible use after free
authorEric Dumazet <[email protected]>
Mon, 2 Oct 2017 19:20:51 +0000 (12:20 -0700)
committerDavid S. Miller <[email protected]>
Mon, 2 Oct 2017 22:23:42 +0000 (15:23 -0700)
commiteefca20eb20c66b06cf5ed09b49b1a7caaa27b7b
tree49ff0df975ed5fc89db450ca9b17ed040c1f7939
parent4ee4553e861a2a7c4f5b045d9453729d837d4a7d
socket, bpf: fix possible use after free

Starting from linux-4.4, 3WHS no longer takes the listener lock.

Since this time, we might hit a use-after-free in sk_filter_charge(),
if the filter we got in the memcpy() of the listener content
just happened to be replaced by a thread changing listener BPF filter.

To fix this, we need to make sure the filter refcount is not already
zero before incrementing it again.

Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Signed-off-by: Eric Dumazet <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
net/core/filter.c
net/core/sock.c
This page took 0.058045 seconds and 4 git commands to generate.