]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Mar 2019 06:08:16 +0000 (07:08 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Mar 2019 06:08:16 +0000 (07:08 +0100)
added patches:
tun-add-a-missing-rcu_read_unlock-in-error-path.patch

queue-4.14/series
queue-4.14/tun-add-a-missing-rcu_read_unlock-in-error-path.patch [new file with mode: 0644]

index 9a998c2677d410889f9703ce6a5ebfe12522bd8f..5374814feb572f62e133e22ff0b2298ab58bea93 100644 (file)
@@ -21,3 +21,4 @@ sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch
 net-aquantia-fix-rx-checksum-offload-for-udp-tcp-over-ipv6.patch
 mac8390-fix-mmio-access-size-probe.patch
 tun-properly-test-for-iff_up.patch
+tun-add-a-missing-rcu_read_unlock-in-error-path.patch
diff --git a/queue-4.14/tun-add-a-missing-rcu_read_unlock-in-error-path.patch b/queue-4.14/tun-add-a-missing-rcu_read_unlock-in-error-path.patch
new file mode 100644 (file)
index 0000000..f96e1ba
--- /dev/null
@@ -0,0 +1,32 @@
+From 9180bb4f046064dfa4541488102703b402bb04e1 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 16 Mar 2019 13:09:53 -0700
+Subject: tun: add a missing rcu_read_unlock() in error path
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 9180bb4f046064dfa4541488102703b402bb04e1 upstream.
+
+In my latest patch I missed one rcu_read_unlock(), in case
+device is down.
+
+Fixes: 4477138fa0ae ("tun: properly test for IFF_UP")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/tun.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1569,6 +1569,7 @@ drop:
+       rcu_read_lock();
+       if (unlikely(!(tun->dev->flags & IFF_UP))) {
+               err = -EIO;
++              rcu_read_unlock();
+               goto drop;
+       }