]>
Commit | Line | Data |
---|---|---|
08aa9d92 | 1 | --- linux-2.6.33/scripts/mod/modpost.c~ 2010-02-24 19:52:17.000000000 +0100 |
2 | +++ linux-2.6.33/scripts/mod/modpost.c 2010-03-07 14:26:47.242168558 +0100 | |
3 | @@ -15,7 +15,8 @@ | |
4 | #include <stdio.h> | |
5 | #include <ctype.h> | |
6 | #include "modpost.h" | |
7 | -#include "../../include/generated/autoconf.h" | |
8 | +// PLD architectures don't use CONFIG_SYMBOL_PREFIX | |
9 | +//#include "../../include/generated/autoconf.h" | |
10 | #include "../../include/linux/license.h" | |
11 | ||
12 | /* Some toolchains use a `_' prefix for all user symbols. */ | |
13 | ||
2136e199 AM |
14 | --- linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh~ 2011-07-22 04:17:23.000000000 +0200 |
15 | +++ linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh 2011-08-25 21:26:04.799150642 +0200 | |
16 | @@ -9,6 +9,12 @@ | |
17 | $cc -print-file-name=lib${lib}.${ext} | grep -q / | |
18 | if [ $? -eq 0 ]; then | |
19 | echo "-l${lib}" | |
20 | + for libt in tinfow tinfo ; do | |
21 | + $cc -print-file-name=lib${libt}.${ext} | grep -q / | |
22 | + if [ $? -eq 0 ]; then | |
23 | + echo "-l${libt}" | |
24 | + fi | |
25 | + done | |
26 | exit | |
27 | fi | |
28 | done | |
464edd60 JR |
29 | --- a/Makefile 2016-11-10 20:41:43.646224629 +0100 |
30 | +++ b/Makefile 2016-11-10 20:40:35.640323501 +0100 | |
31 | @@ -784,6 +774,9 @@ | |
32 | # Prohibit date/time macros, which would make the build non-deterministic | |
33 | KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) | |
34 | ||
35 | +# enforce correct pointer usage | |
36 | +KBUILD_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types) | |
37 | + | |
38 | # use the deterministic mode of AR if available | |
39 | KBUILD_ARFLAGS := $(call ar-option,D) | |
40 | ||
83f98831 AM |
41 | From 84ac7260236a49c79eede91617700174c2c19b0c Mon Sep 17 00:00:00 2001 |
42 | From: Philip Pettersson <philip.pettersson@gmail.com> | |
43 | Date: Wed, 30 Nov 2016 14:55:36 -0800 | |
44 | Subject: packet: fix race condition in packet_set_ring | |
45 | ||
46 | When packet_set_ring creates a ring buffer it will initialize a | |
47 | struct timer_list if the packet version is TPACKET_V3. This value | |
48 | can then be raced by a different thread calling setsockopt to | |
49 | set the version to TPACKET_V1 before packet_set_ring has finished. | |
50 | ||
51 | This leads to a use-after-free on a function pointer in the | |
52 | struct timer_list when the socket is closed as the previously | |
53 | initialized timer will not be deleted. | |
54 | ||
55 | The bug is fixed by taking lock_sock(sk) in packet_setsockopt when | |
56 | changing the packet version while also taking the lock at the start | |
57 | of packet_set_ring. | |
58 | ||
59 | Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") | |
60 | Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> | |
61 | Signed-off-by: Eric Dumazet <edumazet@google.com> | |
62 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
63 | --- | |
64 | net/packet/af_packet.c | 18 ++++++++++++------ | |
65 | 1 file changed, 12 insertions(+), 6 deletions(-) | |
66 | ||
67 | diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c | |
68 | index d2238b2..dd23323 100644 | |
69 | --- a/net/packet/af_packet.c | |
70 | +++ b/net/packet/af_packet.c | |
71 | @@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv | |
72 | ||
73 | if (optlen != sizeof(val)) | |
74 | return -EINVAL; | |
75 | - if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) | |
76 | - return -EBUSY; | |
77 | if (copy_from_user(&val, optval, sizeof(val))) | |
78 | return -EFAULT; | |
79 | switch (val) { | |
80 | case TPACKET_V1: | |
81 | case TPACKET_V2: | |
82 | case TPACKET_V3: | |
83 | - po->tp_version = val; | |
84 | - return 0; | |
85 | + break; | |
86 | default: | |
87 | return -EINVAL; | |
88 | } | |
89 | + lock_sock(sk); | |
90 | + if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { | |
91 | + ret = -EBUSY; | |
92 | + } else { | |
93 | + po->tp_version = val; | |
94 | + ret = 0; | |
95 | + } | |
96 | + release_sock(sk); | |
97 | + return ret; | |
98 | } | |
99 | case PACKET_RESERVE: | |
100 | { | |
101 | @@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, | |
102 | /* Added to avoid minimal code churn */ | |
103 | struct tpacket_req *req = &req_u->req; | |
104 | ||
105 | + lock_sock(sk); | |
106 | /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ | |
107 | if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { | |
108 | net_warn_ratelimited("Tx-ring is not supported.\n"); | |
109 | @@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, | |
110 | goto out; | |
111 | } | |
112 | ||
113 | - lock_sock(sk); | |
114 | ||
115 | /* Detach socket from network */ | |
116 | spin_lock(&po->bind_lock); | |
117 | @@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, | |
118 | if (!tx_ring) | |
119 | prb_shutdown_retire_blk_timer(po, rb_queue); | |
120 | } | |
121 | - release_sock(sk); | |
122 | ||
123 | if (pg_vec) | |
124 | free_pg_vec(pg_vec, order, req->tp_block_nr); | |
125 | out: | |
126 | + release_sock(sk); | |
127 | return err; | |
128 | } | |
129 | ||
130 | -- | |
131 | cgit v0.12 | |
132 |