Skip to content

Commit

Permalink
xps: must clear sender_cpu before forwarding
Browse files Browse the repository at this point in the history
John reported that my previous commit added a regression
on his router.

This is because sender_cpu & napi_id share a common location,
so get_xps_queue() can see garbage and perform an out of bound access.

We need to make sure sender_cpu is cleared before doing the transmit,
otherwise any NIC busy poll enabled (skb_mark_napi_id()) can trigger
this bug.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: John <jw@nuclearfallout.net>
Bisected-by: John <jw@nuclearfallout.net>
Fixes: 2bd8248 ("xps: fix xps for stacked devices")
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Eric Dumazet authored and David S. Miller committed Mar 12, 2015
1 parent c8a4d29 commit c29390c
Show file tree
Hide file tree
Showing 4 changed files with 10 additions and 1 deletion.
7 changes: 7 additions & 0 deletions include/linux/skbuff.h
Original file line number Diff line number Diff line change
Expand Up @@ -948,6 +948,13 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from)
to->l4_hash = from->l4_hash;
};

static inline void skb_sender_cpu_clear(struct sk_buff *skb)
{
#ifdef CONFIG_XPS
skb->sender_cpu = 0;
#endif
}

#ifdef NET_SKBUFF_DATA_USES_OFFSET
static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
{
Expand Down
2 changes: 1 addition & 1 deletion net/core/skbuff.c
Original file line number Diff line number Diff line change
Expand Up @@ -4173,7 +4173,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
skb->ignore_df = 0;
skb_dst_drop(skb);
skb->mark = 0;
skb->sender_cpu = 0;
skb_sender_cpu_clear(skb);
skb_init_secmark(skb);
secpath_reset(skb);
nf_reset(skb);
Expand Down
1 change: 1 addition & 0 deletions net/ipv4/ip_forward.c
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ static int ip_forward_finish(struct sk_buff *skb)
if (unlikely(opt->optlen))
ip_forward_options(skb);

skb_sender_cpu_clear(skb);
return dst_output(skb);
}

Expand Down
1 change: 1 addition & 0 deletions net/ipv6/ip6_output.c
Original file line number Diff line number Diff line change
Expand Up @@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)

static inline int ip6_forward_finish(struct sk_buff *skb)
{
skb_sender_cpu_clear(skb);
return dst_output(skb);
}

Expand Down

0 comments on commit c29390c

Please sign in to comment.