iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
c29390c6df
linux/net
History
Eric Dumazet c29390c6df xps: must clear sender_cpu before forwarding 
John reported that my previous commit added a regression
on his router.

This is because sender_cpu & napi_id share a common location,
so get_xps_queue() can see garbage and perform an out of bound access.

We need to make sure sender_cpu is cleared before doing the transmit,
otherwise any NIC busy poll enabled (skb_mark_napi_id()) can trigger
this bug.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: John <jw@nuclearfallout.net>
Bisected-by: John <jw@nuclearfallout.net>
Fixes: 2bd82484bb ("xps: fix xps for stacked devices")
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-03-11 23:51:18 -04:00
..
6lowpan
9p virtio/9p: verify device has config space 2015-01-21 16:28:45 +10:30
802
8021q vlan: advertise link netns via netlink 2015-01-23 17:51:15 -08:00
appletalk
atm put iov_iter into msghdr 2014-12-09 16:29:03 -05:00
ax25
batman-adv batman-adv: Kconfig, Add missing DEBUG_FS dependency 2015-01-07 22:17:11 +01:00
bluetooth Bluetooth: Fix potential NULL dereference 2015-02-03 09:02:12 +01:00
bridge net: bridge: add compile-time assert for cb struct size 2015-03-03 14:07:04 -05:00
caif caif: fix a signedness bug in cfpkt_iterate() 2015-02-20 17:35:14 -05:00
can can: add missing initialisations in CAN related skbuffs 2015-03-09 10:22:24 +01:00
ceph Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2015-02-19 14:14:42 -08:00
core xps: must clear sender_cpu before forwarding 2015-03-11 23:51:18 -04:00
dcb
dccp net: introduce helper macro for_each_cmsghdr 2014-12-10 22:41:55 -05:00
decnet decnet: Fix obvious o/0 typo 2015-02-23 15:28:50 -05:00
dns_resolver
dsa net: dsa: Set valid phy interface type 2015-02-17 10:37:39 -08:00
ethernet net: Add Transparent Ethernet Bridging GRO support. 2015-01-02 15:46:41 -05:00
hsr net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface. 2015-03-01 13:40:23 -05:00
ieee802154 netlink: make nlmsg_end() and genlmsg_end() void 2015-01-18 01:03:45 -05:00
ipv4 xps: must clear sender_cpu before forwarding 2015-03-11 23:51:18 -04:00
ipv6 xps: must clear sender_cpu before forwarding 2015-03-11 23:51:18 -04:00
ipx
irda TTY/Serial fixes for 4.0-rc3 2015-03-08 12:25:40 -07:00
iucv net: introduce helper macro for_each_cmsghdr 2014-12-10 22:41:55 -05:00
key
l2tp netlink: make nlmsg_end() and genlmsg_end() void 2015-01-18 01:03:45 -05:00
lapb
llc net: llc: use correct size for sysctl timeout entries 2015-01-25 00:23:21 -08:00
mac80211 mac80211: Send EAPOL frames at lowest rate 2015-02-26 21:03:06 +01:00
mac802154 mac802154: fix kbuild test robot warning 2015-01-03 01:51:51 +01:00
mpls net: mark some potential candidates __read_mostly 2015-01-30 17:58:39 -08:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf 2015-03-05 21:51:07 -05:00
netlabel Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2015-02-11 20:25:11 -08:00
netlink rhashtable: remove indirection for grow/shrink decision functions 2015-02-27 16:06:02 -05:00
netrom
nfc NFC: nci: Move NFCEE discovery logic 2015-02-04 09:15:18 +01:00
openvswitch openvswitch: Fix serialization of non-masked set actions. 2015-03-03 14:38:57 -05:00
packet net: delete stale packet_mclist entries 2015-03-09 16:17:43 -04:00
phonet phonet netlink: allow multiple messages per skb in route dump 2015-01-19 16:20:17 -05:00
rds rds: rds_cong_queue_updates needs to defer the congestion update transmission 2015-02-11 14:35:44 -08:00
rfkill Last round of updates for net-next: 2015-02-04 14:57:45 -08:00
rose
rxrpc ip: fix error queue empty skb handling 2015-03-08 23:01:54 -04:00
sched net_sched: fix struct tc_u_hnode layout in u32 2015-03-09 23:44:31 -04:00
sctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-02-05 14:33:28 -08:00
sunrpc sunrpc: fix braino in ->poll() 2015-03-08 12:53:46 -07:00
switchdev Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2015-02-19 10:36:45 -08:00
tipc tipc: fix bug in link failover handling 2015-03-09 16:20:41 -04:00
unix net: remove sock_iocb 2015-01-28 23:15:07 -08:00
vmw_vsock vmci: propagate msghdr all way down to __qp_memcpy_to_queue() 2015-02-04 01:34:14 -05:00
wimax
wireless cfg80211: calls nl80211_exit on error 2015-02-24 11:41:21 +01:00
x25
xfrm netlink: make nlmsg_end() and genlmsg_end() void 2015-01-18 01:03:45 -05:00
compat.c net: compat: Ignore MSG_CMSG_COMPAT in compat_sys_{send, recv}msg 2015-02-23 17:22:05 -05:00
Kconfig kconfig: use bool instead of boolean for type definition attributes 2015-01-07 13:08:04 +01:00
Makefile Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2014-12-16 15:53:03 -08:00
socket.c net: switch sockets to ->read_iter/->write_iter 2015-02-04 01:34:15 -05:00
sysctl_net.c