diff options
| author | Eric Dumazet | 2015-03-12 02:42:02 +0100 |
|---|---|---|
| committer | David S. Miller | 2015-03-12 04:51:18 +0100 |
| commit | c29390c6dfeee0944ac6b5610ebbe403944378fc (patch) | |
| tree | befe951b043be948957abb1db65cee36dd7a379b /net/ipv6 | |
| parent | xen-netback: notify immediately after pushing Tx response. (diff) | |
| download | kernel-qcow2-linux-c29390c6dfeee0944ac6b5610ebbe403944378fc.tar.gz kernel-qcow2-linux-c29390c6dfeee0944ac6b5610ebbe403944378fc.tar.xz kernel-qcow2-linux-c29390c6dfeee0944ac6b5610ebbe403944378fc.zip | |
xps: must clear sender_cpu before forwarding
John reported that my previous commit added a regression
on his router.
This is because sender_cpu & napi_id share a common location,
so get_xps_queue() can see garbage and perform an out of bound access.
We need to make sure sender_cpu is cleared before doing the transmit,
otherwise any NIC busy poll enabled (skb_mark_napi_id()) can trigger
this bug.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: John <jw@nuclearfallout.net>
Bisected-by: John <jw@nuclearfallout.net>
Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices")
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/ip6_output.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 0a04a37305d5..7e80b61b51ff 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb) static inline int ip6_forward_finish(struct sk_buff *skb) { + skb_sender_cpu_clear(skb); return dst_output(skb); } |