netdev - Re: [PATCH net] packet: avoid out of bounds read in round robin fanout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+FuTSdqdUxJab_zoQrYU7AJOnhceqOqhR_HCcpCaaJu55o8hQ@mail.gmail.com>
Date:	Tue, 16 Jun 2015 17:51:53 -0400
From:	Willem de Bruijn <willemb@...gle.com>
To:	Network Development <netdev@...r.kernel.org>
Cc:	David Miller <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net] packet: avoid out of bounds read in round robin fanout

On Tue, Jun 16, 2015 at 5:07 PM, Willem de Bruijn <willemb@...gle.com> wrote:
> From: Willem de Bruijn <willemb@...gle.com>
>
> PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
> f->num_members. It returns the old value unconditionally, but
> f->num_members may have changed since the last store. This can be
> fixed with
>
>   -        return cur
>   +        return cur < num ? : 0;

Well, that test is bad. Should be return cur < num ? cur : 0. But the
patch is more concise, anyway.

>
> When modifying the logic, simplify it further by replacing the loop
> with an unconditional atomic increment.
>
> Fixes: dc99f600698d ("packet: Add fanout support.")
> Suggested-by: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: Willem de Bruijn <willemb@...gle.com>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html