From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Willem de Bruijn <willemb@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.14 07/30] packet: avoid out of bounds read in round robin fanout
Date: Wed, 8 Jul 2015 00:34:06 -0700 [thread overview]
Message-ID: <20150708073157.440666711@linuxfoundation.org> (raw)
In-Reply-To: <20150708073155.841723465@linuxfoundation.org>
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]
PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
f->num_members. It returns the old value unconditionally, but
f->num_members may have changed since the last store. Ensure
that the return value is always < num.
When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.
Fixes: dc99f600698d ("packet: Add fanout support.")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 18 ++----------------
1 file changed, 2 insertions(+), 16 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct
sk_refcnt_debug_dec(sk);
}
-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
-{
- int x = atomic_read(&f->rr_cur) + 1;
-
- if (x >= num)
- x = 0;
-
- return x;
-}
-
static unsigned int fanout_demux_hash(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(stru
struct sk_buff *skb,
unsigned int num)
{
- int cur, old;
+ unsigned int val = atomic_inc_return(&f->rr_cur);
- cur = atomic_read(&f->rr_cur);
- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
- fanout_rr_next(f, num))) != cur)
- cur = old;
- return cur;
+ return val % num;
}
static unsigned int fanout_demux_cpu(struct packet_fanout *f,
next prev parent reply other threads:[~2015-07-08 7:35 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-08 7:33 [PATCH 3.14 00/30] 3.14.48-stable review Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 01/30] sparc: Use GFP_ATOMIC in ldc_alloc_exp_dring() as it can be called in softirq context Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 02/30] bridge: fix multicast router rlist endless loop Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 03/30] net: dont wait for order-3 page allocation Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 04/30] sctp: fix ASCONF list handling Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 05/30] bridge: fix br_stp_set_bridge_priority race conditions Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 06/30] packet: read num_members once in packet_rcv_fanout() Greg Kroah-Hartman
2015-07-08 7:34 ` Greg Kroah-Hartman [this message]
2015-07-08 7:34 ` [PATCH 3.14 08/30] neigh: do not modify unlinked entries Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 09/30] tcp: Do not call tcp_fastopen_reset_cipher from interrupt context Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 10/30] net: phy: fix phy link up when limiting speed via device tree Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 11/30] sctp: Fix race between OOTB responce and route removal Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 12/30] crypto: talitos - avoid memleak in talitos_alg_alloc() Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 13/30] Revert "crypto: talitos - convert to use be16_add_cpu()" Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 14/30] iommu/amd: Handle large pages correctly in free_pagetable Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 15/30] intel_pstate: set BYT MSR with wrmsrl_on_cpu() Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 16/30] arm: KVM: force execution of HCPTR access on VM exit Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 17/30] powerpc/perf: Fix book3s kernel to userspace backtraces Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 18/30] x86/PCI: Use host bridge _CRS info on systems with >32 bit addressing Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 19/30] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 20/30] MIPS: Fix KVM guest fixmap address Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 22/30] fs: Fix S_NOSEC handling Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 23/30] vfs: Remove incorrect debugging WARN in prepend_path Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 24/30] vfs: Ignore unlocked mounts in fs_fully_visible Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 25/30] arm/arm64: KVM: Require in-kernel vgic for the arch timers Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 26/30] arm64: KVM: Fix TLB invalidation by IPA/VMID Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 27/30] arm64: KVM: Fix HCR setting for 32bit guests Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 28/30] arm64: KVM: Do not use pgd_index to index stage-2 pgd Greg Kroah-Hartman
2015-07-08 7:34 ` [PATCH 3.14 30/30] x86/iosf: Add Kconfig prompt for IOSF_MBI selection Greg Kroah-Hartman
2015-07-08 14:07 ` [PATCH 3.14 00/30] 3.14.48-stable review Guenter Roeck
2015-07-08 14:57 ` Sudip Mukherjee
2015-07-08 16:33 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150708073157.440666711@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).