xps: must clear sender_cpu before forwarding
authorEric Dumazet <edumazet@google.com>
Thu, 12 Mar 2015 01:42:02 +0000 (18:42 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 12 Mar 2015 03:51:18 +0000 (23:51 -0400)
commitc29390c6dfeee0944ac6b5610ebbe403944378fc
treebefe951b043be948957abb1db65cee36dd7a379b
parentc8a4d29988edb0db9ee80669f2e5e21bd9f7e0d0
xps: must clear sender_cpu before forwarding

John reported that my previous commit added a regression
on his router.

This is because sender_cpu & napi_id share a common location,
so get_xps_queue() can see garbage and perform an out of bound access.

We need to make sure sender_cpu is cleared before doing the transmit,
otherwise any NIC busy poll enabled (skb_mark_napi_id()) can trigger
this bug.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: John <jw@nuclearfallout.net>
Bisected-by: John <jw@nuclearfallout.net>
Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices")
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/skbuff.h
net/core/skbuff.c
net/ipv4/ip_forward.c
net/ipv6/ip6_output.c