]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Mar 2019 06:07:56 +0000 (07:07 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Mar 2019 06:07:56 +0000 (07:07 +0100)
added patches:
tun-add-a-missing-rcu_read_unlock-in-error-path.patch

queue-4.9/series
queue-4.9/tun-add-a-missing-rcu_read_unlock-in-error-path.patch [new file with mode: 0644]

index 11d1f7ae5fcb0f1345658e1b5ac5acc4263d3012..a3053acd72b1fe5cf099f6d9bfff5bb23ed2561d 100644 (file)
@@ -14,3 +14,4 @@ vxlan-don-t-call-gro_cells_destroy-before-device-is-unregistered.patch
 sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch
 mac8390-fix-mmio-access-size-probe.patch
 tun-properly-test-for-iff_up.patch
+tun-add-a-missing-rcu_read_unlock-in-error-path.patch
diff --git a/queue-4.9/tun-add-a-missing-rcu_read_unlock-in-error-path.patch b/queue-4.9/tun-add-a-missing-rcu_read_unlock-in-error-path.patch
new file mode 100644 (file)
index 0000000..abe19e1
--- /dev/null
@@ -0,0 +1,32 @@
+From 9180bb4f046064dfa4541488102703b402bb04e1 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 16 Mar 2019 13:09:53 -0700
+Subject: tun: add a missing rcu_read_unlock() in error path
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 9180bb4f046064dfa4541488102703b402bb04e1 upstream.
+
+In my latest patch I missed one rcu_read_unlock(), in case
+device is down.
+
+Fixes: 4477138fa0ae ("tun: properly test for IFF_UP")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/tun.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1330,6 +1330,7 @@ drop:
+       rcu_read_lock();
+       if (unlikely(!(tun->dev->flags & IFF_UP))) {
+               err = -EIO;
++              rcu_read_unlock();
+               goto drop;
+       }