mirror of
https://github.com/archlinuxarm/PKGBUILDs.git
synced 2024-11-18 22:54:00 +00:00
core/linux-raspberrypi to 4.4.37-1
This commit is contained in:
Kevin Mihelich
parent
dc2f095216
commit
b22035f516
2 changed files with 99 additions and 3 deletions
|
|
@ -0,0 +1,92 @@
|
|||
From a55243d4fa9734378aa3ef1aa612a4c836b8215e Mon Sep 17 00:00:00 2001
|
||||
From: Philip Pettersson <philip.pettersson@gmail.com>
|
||||
Date: Wed, 30 Nov 2016 14:55:36 -0800
|
||||
Subject: [PATCH] packet: fix race condition in packet_set_ring
|
||||
|
||||
When packet_set_ring creates a ring buffer it will initialize a
|
||||
struct timer_list if the packet version is TPACKET_V3. This value
|
||||
can then be raced by a different thread calling setsockopt to
|
||||
set the version to TPACKET_V1 before packet_set_ring has finished.
|
||||
|
||||
This leads to a use-after-free on a function pointer in the
|
||||
struct timer_list when the socket is closed as the previously
|
||||
initialized timer will not be deleted.
|
||||
|
||||
The bug is fixed by taking lock_sock(sk) in packet_setsockopt when
|
||||
changing the packet version while also taking the lock at the start
|
||||
of packet_set_ring.
|
||||
|
||||
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
|
||||
Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com>
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/packet/af_packet.c | 18 ++++++++++++------
|
||||
1 file changed, 12 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
|
||||
index 34e4fcf..f223d1c 100644
|
||||
--- a/net/packet/af_packet.c
|
||||
+++ b/net/packet/af_packet.c
|
||||
@@ -3572,19 +3572,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
|
||||
|
||||
if (optlen != sizeof(val))
|
||||
return -EINVAL;
|
||||
- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
|
||||
- return -EBUSY;
|
||||
if (copy_from_user(&val, optval, sizeof(val)))
|
||||
return -EFAULT;
|
||||
switch (val) {
|
||||
case TPACKET_V1:
|
||||
case TPACKET_V2:
|
||||
case TPACKET_V3:
|
||||
- po->tp_version = val;
|
||||
- return 0;
|
||||
+ break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
+ lock_sock(sk);
|
||||
+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
|
||||
+ ret = -EBUSY;
|
||||
+ } else {
|
||||
+ po->tp_version = val;
|
||||
+ ret = 0;
|
||||
+ }
|
||||
+ release_sock(sk);
|
||||
+ return ret;
|
||||
}
|
||||
case PACKET_RESERVE:
|
||||
{
|
||||
@@ -4067,6 +4073,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
|
||||
/* Added to avoid minimal code churn */
|
||||
struct tpacket_req *req = &req_u->req;
|
||||
|
||||
+ lock_sock(sk);
|
||||
/* Opening a Tx-ring is NOT supported in TPACKET_V3 */
|
||||
if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
|
||||
WARN(1, "Tx-ring is not supported.\n");
|
||||
@@ -4148,7 +4155,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
|
||||
goto out;
|
||||
}
|
||||
|
||||
- lock_sock(sk);
|
||||
|
||||
/* Detach socket from network */
|
||||
spin_lock(&po->bind_lock);
|
||||
@@ -4197,11 +4203,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
|
||||
if (!tx_ring)
|
||||
prb_shutdown_retire_blk_timer(po, rb_queue);
|
||||
}
|
||||
- release_sock(sk);
|
||||
|
||||
if (pg_vec)
|
||||
free_pg_vec(pg_vec, order, req->tp_block_nr);
|
||||
out:
|
||||
+ release_sock(sk);
|
||||
return err;
|
||||
}
|
||||
|
||||
--
|
||||
2.10.2
|
||||
|
||||
|
|
@ -7,11 +7,11 @@
|
|||
buildarch=20
|
||||
|
||||
pkgbase=linux-raspberrypi
|
||||
_commit=c6d86f7aa554854b04614ebb4d394766081fb41f
|
||||
_commit=830c04fea80e48ecf1de1fc64c703b495713af17
|
||||
_srcname=linux-${_commit}
|
||||
_kernelname=${pkgbase#linux}
|
||||
_desc="Raspberry Pi"
|
||||
pkgver=4.4.36
|
||||
pkgver=4.4.37
|
||||
pkgrel=1
|
||||
bfqver=v7r11
|
||||
arch=('armv6h' 'armv7h')
|
||||
|
|
@ -25,17 +25,19 @@ source=("https://github.com/raspberrypi/linux/archive/${_commit}.tar.gz"
|
|||
"bfq2.patch::ftp://teambelgium.net/bfq/patches/${pkgver%.*}.0-${bfqver}/0002-block-introduce-the-BFQ-${bfqver}-I-O-sched-for-${pkgver%.*}.0.patch"
|
||||
"bfq3.patch::ftp://teambelgium.net/bfq/patches/${pkgver%.*}.0-${bfqver}/0003-block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-${bfqver}-for.patch"
|
||||
'https://archlinuxarm.org/builder/src/brcmfmac43430-sdio.bin' 'https://archlinuxarm.org/builder/src/brcmfmac43430-sdio.txt'
|
||||
'0001-packet-fix-race-condition-in-packet_set_ring.patch'
|
||||
'config.txt'
|
||||
'cmdline.txt'
|
||||
'config.v6'
|
||||
'config.v7')
|
||||
md5sums=('b29484047fcd13d947ad40800e1671d9'
|
||||
md5sums=('6f0f653c0bd0a6ea4f73377bd5f9425e'
|
||||
'SKIP'
|
||||
'c1d7fcfe88edb658375089c0a9cc1811'
|
||||
'953133d5e387de2ad79ac0ae5c27cb6b'
|
||||
'f0387e673975e9f2a5e05136948edece'
|
||||
'4a410ab9a1eefe82e158d36df02b3589'
|
||||
'8c3cb6d8f0609b43f09d083b4006ec5a'
|
||||
'cf225f2c902e596fab6f0ffc2adc26b5'
|
||||
'f95eb9c22c18722e30fc28a5640aeba5'
|
||||
'60bc3624123c183305677097bcd56212'
|
||||
'69314c5968a997b89b2ad7fbe5575d82'
|
||||
|
|
@ -44,6 +46,8 @@ md5sums=('b29484047fcd13d947ad40800e1671d9'
|
|||
prepare() {
|
||||
cd "${srcdir}/${_srcname}"
|
||||
|
||||
patch -Np1 -i ../0001-packet-fix-race-condition-in-packet_set_ring.patch
|
||||
|
||||
msg2 "AUFS patches"
|
||||
cp -ru "${srcdir}/aufs4-standalone/Documentation" .
|
||||
cp -ru "${srcdir}/aufs4-standalone/fs" .
|
||||
|
|
|
|||
Loading…
Reference in a new issue