From 6bb37937a52658509b58a3f0349806508ae34a70 Mon Sep 17 00:00:00 2001 From: Stefan Bader Date: Fri, 11 Aug 2017 11:37:14 +0200 Subject: [PATCH] Revert "net-packet: fix race in packet_set_ring on PACKET_RESERVE" This reverts commit e824e06eda7dfac325d937c33cda0d45aaf4509c. CVE-2017-1000111 Signed-off-by: Stefan Bader --- net/packet/af_packet.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index ebde2ef2f122..0f074c96f43f 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3640,19 +3640,14 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv if (optlen != sizeof(val)) return -EINVAL; + if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) + return -EBUSY; if (copy_from_user(&val, optval, sizeof(val))) return -EFAULT; if (val > INT_MAX) return -EINVAL; - lock_sock(sk); - if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) - ret = -EBUSY; - else { - po->tp_reserve = val; - ret = 0; - } - release_sock(sk); - return ret; + po->tp_reserve = val; + return 0; } case PACKET_LOSS: { -- 2.39.2