[3.16.y-ckt stable] Patch "net: graceful exit from netif_alloc_netdev_queues()" has been added to staging queue
Luis Henriques
luis.henriques at canonical.com
Tue Aug 11 12:55:49 UTC 2015
This is a note to let you know that I have just added a patch titled
net: graceful exit from netif_alloc_netdev_queues()
to the linux-3.16.y-queue branch of the 3.16.y-ckt extended stable tree
which can be found at:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-queue
This patch is scheduled to be released in version 3.16.7-ckt16.
If you, or anyone else, feels it should not be added to this tree, please
reply to this email.
For more information about the 3.16.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable
Thanks.
-Luis
------
>From f02f07a474f227349f7faa8826dd68fba80416d0 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet at google.com>
Date: Mon, 6 Jul 2015 17:13:26 +0200
Subject: net: graceful exit from netif_alloc_netdev_queues()
commit d339727c2b1a10f25e6636670ab6e1841170e328 upstream.
User space can crash kernel with
ip link add ifb10 numtxqueues 100000 type ifb
We must replace a BUG_ON() by proper test and return -EINVAL for
crazy values.
Fixes: 60877a32bce00 ("net: allow large number of tx queues")
Signed-off-by: Eric Dumazet <edumazet at google.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
net/core/dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index afa766c453e0..2e616d68a7aa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6049,7 +6049,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
struct netdev_queue *tx;
size_t sz = count * sizeof(*tx);
- BUG_ON(count < 1 || count > 0xffff);
+ if (count < 1 || count > 0xffff)
+ return -EINVAL;
tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
if (!tx) {
More information about the kernel-team
mailing list