[PATCH 3.19.y-ckt 005/251] packet: avoid out of bounds read in round robin fanout
3.19.8-ckt4 -stable review patch. If anyone has any objections, please let me
know.
--
From: Willem de Bruijn
[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]
PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
f->num_members. It returns the old value unconditionally, but
f->num_members may have changed since the last store. Ensure
that the return value is always < num.
When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.
Fixes: dc99f600698d ("packet: Add fanout support.")
Suggested-by: Eric Dumazet
Signed-off-by: Willem de Bruijn
Acked-by: Eric Dumazet
Signed-off-by: David S. Miller
Signed-off-by: Kamal Mostafa
---
net/packet/af_packet.c | 18 ++
1 file changed, 2 insertions(+), 16 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8c7eb97..b215289 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1258,16 +1258,6 @@ static void packet_sock_destruct(struct sock *sk)
sk_refcnt_debug_dec(sk);
}
-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
-{
- int x = atomic_read(>rr_cur) + 1;
-
- if (x >= num)
- x = 0;
-
- return x;
-}
-
static unsigned int fanout_demux_hash(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
@@ -1279,13 +1269,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout
*f,
struct sk_buff *skb,
unsigned int num)
{
- int cur, old;
+ unsigned int val = atomic_inc_return(>rr_cur);
- cur = atomic_read(>rr_cur);
- while ((old = atomic_cmpxchg(>rr_cur, cur,
-fanout_rr_next(f, num))) != cur)
- cur = old;
- return cur;
+ return val % num;
}
static unsigned int fanout_demux_cpu(struct packet_fanout *f,
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 3.19.y-ckt 005/251] packet: avoid out of bounds read in round robin fanout
3.19.8-ckt4 -stable review patch. If anyone has any objections, please let me
know.
--
From: Willem de Bruijn will...@google.com
[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]
PACKET_FANOUT_LB computes f-rr_cur such that it is modulo
f-num_members. It returns the old value unconditionally, but
f-num_members may have changed since the last store. Ensure
that the return value is always num.
When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.
Fixes: dc99f600698d (packet: Add fanout support.)
Suggested-by: Eric Dumazet eduma...@google.com
Signed-off-by: Willem de Bruijn will...@google.com
Acked-by: Eric Dumazet eduma...@google.com
Signed-off-by: David S. Miller da...@davemloft.net
Signed-off-by: Kamal Mostafa ka...@canonical.com
---
net/packet/af_packet.c | 18 ++
1 file changed, 2 insertions(+), 16 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8c7eb97..b215289 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1258,16 +1258,6 @@ static void packet_sock_destruct(struct sock *sk)
sk_refcnt_debug_dec(sk);
}
-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
-{
- int x = atomic_read(f-rr_cur) + 1;
-
- if (x = num)
- x = 0;
-
- return x;
-}
-
static unsigned int fanout_demux_hash(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
@@ -1279,13 +1269,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout
*f,
struct sk_buff *skb,
unsigned int num)
{
- int cur, old;
+ unsigned int val = atomic_inc_return(f-rr_cur);
- cur = atomic_read(f-rr_cur);
- while ((old = atomic_cmpxchg(f-rr_cur, cur,
-fanout_rr_next(f, num))) != cur)
- cur = old;
- return cur;
+ return val % num;
}
static unsigned int fanout_demux_cpu(struct packet_fanout *f,
--
1.9.1
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
