Skip to content
Commit 66e56cd4 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by David S. Miller
Browse files

packet: fix send path when running with proto == 0

Commit e40526cb introduced a cached dev pointer, that gets
hooked into register_prot_hook(), __unregister_prot_hook() to
update the device used for the send path.

We need to fix this up, as otherwise this will not work with
sockets created with protocol = 0, plus with sll_protocol = 0
passed via sockaddr_ll when doing the bind.

So instead, assign the pointer directly. The compiler can inline
these helper functions automagically.

While at it, also assume the cached dev fast-path as likely(),
and document this variant of socket creation as it seems it is
not widely used (seems not even the author of TX_RING was aware
of that in his reference example [1]). Tested with reproducer
from e40526cb.

 [1] http://wiki.ipxwarzone.com/index.php5?title=Linux_packet_mmap#Example



Fixes: e40526cb ("packet: fix use after free race in send path when dev is released")
Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Tested-by: default avatarSalam Noureddine <noureddine@aristanetworks.com>
Tested-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 98bfd23c
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment