From: Willem de Bruijn <[email protected]> Date: Fri, 31 May 2019 12:37:23 -0400
> From: Willem de Bruijn <[email protected]> > > Rollover used to use a complex RCU mechanism for assignment, which had > a race condition. The below patch fixed the bug and greatly simplified > the logic. > > The feature depends on fanout, but the state is private to the socket. > Fanout_release returns f only when the last member leaves and the > fanout struct is to be freed. > > Destroy rollover unconditionally, regardless of fanout state. > > Fixes: 57f015f5eccf2 ("packet: fix crash in fanout_demux_rollover()") > Reported-by: syzbot <[email protected]> > Diagnosed-by: Dmitry Vyukov <[email protected]> > Signed-off-by: Willem de Bruijn <[email protected]> Applied and queued up for -stable.
