OSDN Git Service
(root)
/
android-x86
/
kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
packet: avoid out of bounds read in round robin fanout
[android-x86/kernel.git]
/
net
/
packet
/
af_packet.c
diff --git
a/net/packet/af_packet.c
b/net/packet/af_packet.c
index
b4dfdff
..
bfe5c69
100644
(file)
--- a/
net/packet/af_packet.c
+++ b/
net/packet/af_packet.c
@@
-1266,16
+1266,6
@@
static void packet_sock_destruct(struct sock *sk)
sk_refcnt_debug_dec(sk);
}
sk_refcnt_debug_dec(sk);
}
-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
-{
- int x = atomic_read(&f->rr_cur) + 1;
-
- if (x >= num)
- x = 0;
-
- return x;
-}
-
static unsigned int fanout_demux_hash(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
static unsigned int fanout_demux_hash(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
@@
-1287,13
+1277,9
@@
static unsigned int fanout_demux_lb(struct packet_fanout *f,
struct sk_buff *skb,
unsigned int num)
{
struct sk_buff *skb,
unsigned int num)
{
-
int cur, old
;
+
unsigned int val = atomic_inc_return(&f->rr_cur)
;
- cur = atomic_read(&f->rr_cur);
- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
- fanout_rr_next(f, num))) != cur)
- cur = old;
- return cur;
+ return val % num;
}
static unsigned int fanout_demux_cpu(struct packet_fanout *f,
}
static unsigned int fanout_demux_cpu(struct packet_fanout *f,