tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net/packet: fix a race in packet_set_ring() and packet_notifier()

When packet_set_ring() releases po->bind_lock, another thread can
run packet_notifier() and process an NETDEV_UP event.

This race and the fix are both similar to that of commit 15fe076edea7
("net/packet: fix a race in packet_bind() and packet_notifier()").

There too the packet_notifier NETDEV_UP event managed to run while a
po->bind_lock critical section had to be temporarily released. And
the fix was similarly to temporarily set po->num to zero to keep
the socket unhooked until the lock is retaken.

The po->bind_lock in packet_set_ring and packet_notifier precede the
introduction of git history.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Quang Le <quanglex97@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Quang Le and committed by
Jakub Kicinski 01d3c841 5a40f8af

+6 -6
+6 -6
net/packet/af_packet.c
··· 4573 4573 spin_lock(&po->bind_lock); 4574 4574 was_running = packet_sock_flag(po, PACKET_SOCK_RUNNING); 4575 4575 num = po->num; 4576 - if (was_running) { 4577 - WRITE_ONCE(po->num, 0); 4576 + WRITE_ONCE(po->num, 0); 4577 + if (was_running) 4578 4578 __unregister_prot_hook(sk, false); 4579 - } 4579 + 4580 4580 spin_unlock(&po->bind_lock); 4581 4581 4582 4582 synchronize_net(); ··· 4608 4608 mutex_unlock(&po->pg_vec_lock); 4609 4609 4610 4610 spin_lock(&po->bind_lock); 4611 - if (was_running) { 4612 - WRITE_ONCE(po->num, num); 4611 + WRITE_ONCE(po->num, num); 4612 + if (was_running) 4613 4613 register_prot_hook(sk); 4614 - } 4614 + 4615 4615 spin_unlock(&po->bind_lock); 4616 4616 if (pg_vec && (po->tp_version > TPACKET_V2)) { 4617 4617 /* Because we don't support block-based V3 on tx-ring */