]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.0-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Mar 2019 06:08:53 +0000 (07:08 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Mar 2019 06:08:53 +0000 (07:08 +0100)
added patches:
tun-add-a-missing-rcu_read_unlock-in-error-path.patch

queue-5.0/series
queue-5.0/tun-add-a-missing-rcu_read_unlock-in-error-path.patch [new file with mode: 0644]

index 4b03659602859ae20bf59e0f4ce7850980e75cdd..15ab6945d666e5e491e11f65553314d29a94e7fe 100644 (file)
@@ -34,3 +34,4 @@ net-mii-fix-pause-cap-advertisement-from-linkmode_adv_to_lcl_adv_t-helper.patch
 net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch
 r8169-fix-cable-re-plugging-issue.patch
 ila-fix-rhashtable-walker-list-corruption.patch
+tun-add-a-missing-rcu_read_unlock-in-error-path.patch
diff --git a/queue-5.0/tun-add-a-missing-rcu_read_unlock-in-error-path.patch b/queue-5.0/tun-add-a-missing-rcu_read_unlock-in-error-path.patch
new file mode 100644 (file)
index 0000000..8a186f0
--- /dev/null
@@ -0,0 +1,32 @@
+From 9180bb4f046064dfa4541488102703b402bb04e1 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 16 Mar 2019 13:09:53 -0700
+Subject: tun: add a missing rcu_read_unlock() in error path
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 9180bb4f046064dfa4541488102703b402bb04e1 upstream.
+
+In my latest patch I missed one rcu_read_unlock(), in case
+device is down.
+
+Fixes: 4477138fa0ae ("tun: properly test for IFF_UP")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/tun.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1960,6 +1960,7 @@ drop:
+       rcu_read_lock();
+       if (unlikely(!(tun->dev->flags & IFF_UP))) {
+               err = -EIO;
++              rcu_read_unlock();
+               goto drop;
+       }