From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Willem de Bruijn <willemb@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.14 06/30] packet: read num_members once in packet_rcv_fanout()
Date: Wed, 8 Jul 2015 00:34:05 -0700 [thread overview]
Message-ID: <20150708073157.248104117@linuxfoundation.org> (raw)
In-Reply-To: <20150708073155.841723465@linuxfoundation.org>
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f98f4514d07871da7a113dd9e3e330743fd70ae4 ]
We need to tell compiler it must not read f->num_members multiple
times. Otherwise testing if num is not zero is flaky, and we could
attempt an invalid divide by 0 in fanout_demux_cpu()
Note bug was present in packet_rcv_fanout_hash() and
packet_rcv_fanout_lb() but final 3.1 had a simple location
after commit 95ec3eb417115fb ("packet: Add 'cpu' fanout policy.")
Fixes: dc99f600698dc ("packet: Add fanout support.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1345,7 +1345,7 @@ static int packet_rcv_fanout(struct sk_b
struct packet_type *pt, struct net_device *orig_dev)
{
struct packet_fanout *f = pt->af_packet_priv;
- unsigned int num = f->num_members;
+ unsigned int num = ACCESS_ONCE(f->num_members);
struct packet_sock *po;
unsigned int idx;
next prev parent reply other threads:[~2015-07-08 8:28 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-08 7:33 [PATCH 3.14 00/30] 3.14.48-stable review Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 01/30] sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 02/30] bridge: fix multicast router rlist endless loop Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 03/30] net: dont wait for order-3 page allocation Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 04/30] sctp: fix ASCONF list handling Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 05/30] bridge: fix br_stp_set_bridge_priority race conditions Greg Kroah-Hartman
2015-07-08 7:34 ` Greg Kroah-Hartman [this message]
2015-07-08 7:34 ` [PATCH 3.14 07/30] packet: avoid out of bounds read in round robin fanout Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 08/30] neigh: do not modify unlinked entries Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 09/30] tcp: Do not call tcp_fastopen_reset_cipher from interrupt context Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 10/30] net: phy: fix phy link up when limiting speed via device tree Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 11/30] sctp: Fix race between OOTB responce and route removal Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 12/30] crypto: talitos - avoid memleak in talitos_alg_alloc() Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 13/30] Revert "crypto: talitos - convert to use be16_add_cpu()" Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 14/30] iommu/amd: Handle large pages correctly in free_pagetable Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 15/30] intel_pstate: set BYT MSR with wrmsrl_on_cpu() Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 16/30] arm: KVM: force execution of HCPTR access on VM exit Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 17/30] powerpc/perf: Fix book3s kernel to userspace backtraces Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 18/30] x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 19/30] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 20/30] MIPS: Fix KVM guest fixmap address Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 22/30] fs: Fix S_NOSEC handling Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 23/30] vfs: Remove incorrect debugging WARN in prepend_path Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 24/30] vfs: Ignore unlocked mounts in fs_fully_visible Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 25/30] arm/arm64: KVM: Require in-kernel vgic for the arch timers Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 26/30] arm64: KVM: Fix TLB invalidation by IPA/VMID Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 27/30] arm64: KVM: Fix HCR setting for 32bit guests Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 28/30] arm64: KVM: Do not use pgd_index to index stage-2 pgd Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 30/30] x86/iosf: Add Kconfig prompt for IOSF_MBI selection Greg Kroah-Hartman
2015-07-08 14:07 ` [PATCH 3.14 00/30] 3.14.48-stable review Guenter Roeck
2015-07-08 14:57 ` Sudip Mukherjee
2015-07-08 16:33 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150708073157.248104117@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).