netdev - Re: multiqueue, skb_get_queue_mapping() and netdev_get_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20100715162201.GB32397@esk.cs.usu.edu>
Date:	Thu, 15 Jul 2010 10:22:02 -0600
From:	Eldon Koyle <esk-netdev@....cs.usu.edu>
To:	netdev@...r.kernel.org
Subject: Re: multiqueue, skb_get_queue_mapping() and netdev_get_tx_queue()

On  Jul 14 17:13-0600, Eldon Koyle wrote:
> It looks like there is a potential for an out of bounds index anywhere
> skb_get_queue_mapping(skb) (which just returns skb->queue_mapping) is
> used to get an index for netdev_get_tx_queue() (and probably other
> places) on a device with multiple rx/tx queues.

Looking more closely, it looks like skb->queue_mapping is treated
differently between rx and tx.  In net/core/dev.c in dev_pick_tx, it
uses skb_tx_hash to get the tx queue it should use and then does:
	skb_set_queue_mapping(skb, queue_index);
	return netdev_get_tx_queue(dev, queue_index);

Sorry for the noise.

-- 
Eldon Koyle
-- 
He who renders warfare fatal to all engaged in it will be the greatest
benefactor the world has yet known.
		-- Sir Richard Burton
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html