diff options
| author | Willem de Bruijn <willemb@google.com> | 2015-06-17 15:59:34 -0400 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-08-07 00:32:17 +0100 |
| commit | d77456d7361a00d6a4989f8230570e46e53b19eb (patch) | |
| tree | 38faa05352ce7d6eee43bdef13bd595bc7bad137 /net/ipv6 | |
| parent | f5a27902fd01ffc4b379101c64ac3a8cb69495bd (diff) | |
| download | kernel_samsung_smdk4412-d77456d7361a00d6a4989f8230570e46e53b19eb.zip kernel_samsung_smdk4412-d77456d7361a00d6a4989f8230570e46e53b19eb.tar.gz kernel_samsung_smdk4412-d77456d7361a00d6a4989f8230570e46e53b19eb.tar.bz2 | |
packet: avoid out of bounds read in round robin fanout
[ Upstream commit 468479e6043c84f5a65299cc07cb08a22a28c2b1 ]
PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
f->num_members. It returns the old value unconditionally, but
f->num_members may have changed since the last store. Ensure
that the return value is always < num.
When modifying the logic, simplify it further by replacing the loop
with an unconditional atomic increment.
Fixes: dc99f600698d ("packet: Add fanout support.")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Adjust context
- Demux functions return a sock pointer, not an index]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions