lkml.org 
[lkml]   [2015]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13.y-ckt 005/132] packet: avoid out of bounds read in round robin fanout
    Date
    3.13.11-ckt24 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Willem de Bruijn <willemb@google.com>

    [ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]

    PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
    f->num_members. It returns the old value unconditionally, but
    f->num_members may have changed since the last store. Ensure
    that the return value is always < num.

    When modifying the logic, simplify it further by replacing the loop
    with an unconditional atomic increment.

    Fixes: dc99f600698d ("packet: Add fanout support.")
    Suggested-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/packet/af_packet.c | 18 ++----------------
    1 file changed, 2 insertions(+), 16 deletions(-)

    diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    index e844c61..7f63613 100644
    --- a/net/packet/af_packet.c
    +++ b/net/packet/af_packet.c
    @@ -1150,16 +1150,6 @@ static void packet_sock_destruct(struct sock *sk)
    sk_refcnt_debug_dec(sk);
    }

    -static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
    -{
    - int x = atomic_read(&f->rr_cur) + 1;
    -
    - if (x >= num)
    - x = 0;
    -
    - return x;
    -}
    -
    static unsigned int fanout_demux_hash(struct packet_fanout *f,
    struct sk_buff *skb,
    unsigned int num)
    @@ -1171,13 +1161,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
    struct sk_buff *skb,
    unsigned int num)
    {
    - int cur, old;
    + unsigned int val = atomic_inc_return(&f->rr_cur);

    - cur = atomic_read(&f->rr_cur);
    - while ((old = atomic_cmpxchg(&f->rr_cur, cur,
    - fanout_rr_next(f, num))) != cur)
    - cur = old;
    - return cur;
    + return val % num;
    }

    static unsigned int fanout_demux_cpu(struct packet_fanout *f,
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-07-23 05:01    [W:3.303 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site