{"push_id":1456360154,"size":1,"distinct_size":1,"ref":"refs/heads/n7x-caf","head":"e42747f495c6d5c3eaabbf95d337ede70f751845","before":"24e0c9c5e8599aa210838355ef324bf00b9ae3c2","commits":[{"sha":"e42747f495c6d5c3eaabbf95d337ede70f751845","author":{"name":"Philip Pettersson","email":"a92d5039dce26639c800f4cf2f37bd0c3c2ae41c@gmail.com"},"message":"packet: fix race condition in packet_set_ring\n\nWhen packet_set_ring creates a ring buffer it will initialize a\nstruct timer_list if the packet version is TPACKET_V3. This value\ncan then be raced by a different thread calling setsockopt to\nset the version to TPACKET_V1 before packet_set_ring has finished.\n\nThis leads to a use-after-free on a function pointer in the\nstruct timer_list when the socket is closed as the previously\ninitialized timer will not be deleted.\n\nThe bug is fixed by taking lock_sock(sk) in packet_setsockopt when\nchanging the packet version while also taking the lock at the start\nof packet_set_ring.\n\nChange-Id: Iec8b20f499134e1edd0f9214aa4dde477d1674e1\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nSigned-off-by: Philip Pettersson <philip.pettersson@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/DirtyUnicorns/android_kernel_motorola_msm8992/commits/e42747f495c6d5c3eaabbf95d337ede70f751845"}]}
{"actor":{"display_login":"DirtyUnicorn"}}