Eric Dumazet c29390c6df xps: must clear sender_cpu before forwarding ...

John reported that my previous commit added a regression
on his router.

This is because sender_cpu & napi_id share a common location,
so get_xps_queue() can see garbage and perform an out of bound access.

We need to make sure sender_cpu is cleared before doing the transmit,
otherwise any NIC busy poll enabled (skb_mark_napi_id()) can trigger
this bug.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: John <jw@nuclearfallout.net>
Bisected-by: John <jw@nuclearfallout.net>
Fixes: 2bd82484bb ("xps: fix xps for stacked devices")
Signed-off-by: David S. Miller <davem@davemloft.net>

2015-03-11 23:51:18 -04:00

..

6lowpan

…

9p

virtio/9p: verify device has config space

2015-01-21 16:28:45 +10:30

802

…

8021q

vlan: advertise link netns via netlink

2015-01-23 17:51:15 -08:00

appletalk

…

atm

…

ax25

…

batman-adv

batman-adv: Kconfig, Add missing DEBUG_FS dependency

2015-01-07 22:17:11 +01:00

bluetooth

Bluetooth: Fix potential NULL dereference

2015-02-03 09:02:12 +01:00

bridge

net: bridge: add compile-time assert for cb struct size

2015-03-03 14:07:04 -05:00

caif

caif: fix a signedness bug in cfpkt_iterate()

2015-02-20 17:35:14 -05:00

can

can: add missing initialisations in CAN related skbuffs

2015-03-09 10:22:24 +01:00

ceph

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

2015-02-19 14:14:42 -08:00

core

xps: must clear sender_cpu before forwarding

2015-03-11 23:51:18 -04:00

dcb

…

dccp

…

decnet

decnet: Fix obvious o/0 typo

2015-02-23 15:28:50 -05:00

dns_resolver

…

dsa

net: dsa: Set valid phy interface type

2015-02-17 10:37:39 -08:00

ethernet

net: Add Transparent Ethernet Bridging GRO support.

2015-01-02 15:46:41 -05:00

hsr

net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface.

2015-03-01 13:40:23 -05:00

ieee802154

netlink: make nlmsg_end() and genlmsg_end() void

2015-01-18 01:03:45 -05:00

ipv4

xps: must clear sender_cpu before forwarding

2015-03-11 23:51:18 -04:00

ipv6

xps: must clear sender_cpu before forwarding

2015-03-11 23:51:18 -04:00

ipx

…

irda

Merge tag 'tty-4.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2015-03-08 12:25:40 -07:00

iucv

…

key

…

l2tp

netlink: make nlmsg_end() and genlmsg_end() void

2015-01-18 01:03:45 -05:00

lapb

…

llc

net: llc: use correct size for sysctl timeout entries

2015-01-25 00:23:21 -08:00

mac80211

mac80211: Send EAPOL frames at lowest rate

2015-02-26 21:03:06 +01:00

mac802154

mac802154: fix kbuild test robot warning

2015-01-03 01:51:51 +01:00

mpls

net: mark some potential candidates __read_mostly

2015-01-30 17:58:39 -08:00

netfilter

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf

2015-03-05 21:51:07 -05:00

netlabel

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2015-02-11 20:25:11 -08:00

netlink

rhashtable: remove indirection for grow/shrink decision functions

2015-02-27 16:06:02 -05:00

netrom

…

nfc

NFC: nci: Move NFCEE discovery logic

2015-02-04 09:15:18 +01:00

openvswitch

openvswitch: Fix serialization of non-masked set actions.

2015-03-03 14:38:57 -05:00

packet

net: delete stale packet_mclist entries

2015-03-09 16:17:43 -04:00

phonet

phonet netlink: allow multiple messages per skb in route dump

2015-01-19 16:20:17 -05:00

rds

rds: rds_cong_queue_updates needs to defer the congestion update transmission

2015-02-11 14:35:44 -08:00

rfkill

Merge tag 'mac80211-next-for-davem-2015-02-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2015-02-04 14:57:45 -08:00

rose

…

rxrpc

ip: fix error queue empty skb handling

2015-03-08 23:01:54 -04:00

sched

net_sched: fix struct tc_u_hnode layout in u32

2015-03-09 23:44:31 -04:00

sctp

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-02-05 14:33:28 -08:00

sunrpc

sunrpc: fix braino in ->poll()

2015-03-08 12:53:46 -07:00

switchdev

Merge branch 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild

2015-02-19 10:36:45 -08:00

tipc

tipc: fix bug in link failover handling

2015-03-09 16:20:41 -04:00

unix

net: remove sock_iocb

2015-01-28 23:15:07 -08:00

vmw_vsock

vmci: propagate msghdr all way down to __qp_memcpy_to_queue()

2015-02-04 01:34:14 -05:00

wimax

…

wireless

cfg80211: calls nl80211_exit on error

2015-02-24 11:41:21 +01:00

x25

…

xfrm

netlink: make nlmsg_end() and genlmsg_end() void

2015-01-18 01:03:45 -05:00

compat.c

net: compat: Ignore MSG_CMSG_COMPAT in compat_sys_{send, recv}msg

2015-02-23 17:22:05 -05:00

Kconfig

kconfig: use bool instead of boolean for type definition attributes

2015-01-07 13:08:04 +01:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-12-16 15:53:03 -08:00

socket.c

net: switch sockets to ->read_iter/->write_iter

2015-02-04 01:34:15 -05:00

sysctl_net.c

…