alistair23-linux/net
Tom Herbert b0f77d0eae net: fix problem in reading sock TX queue
Fix problem in reading the tx_queue recorded in a socket.  In
dev_pick_tx, the TX queue is read by doing a check with
sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get.
The problem is that there is not mutual exclusion across these
calls in the socket so it it is possible that the queue in the
sock can be invalidated after sk_tx_queue_recorded is called so
that sk_tx_queue get returns -1, which sets 65535 in queue_index
and thus dev_pick_tx returns 65536 which is a bogus queue and
can cause crash in dev_queue_xmit.

We fix this by only calling sk_tx_queue_get which does the proper
checks.  The interface is that sk_tx_queue_get returns the TX queue
if the sock argument is non-NULL and TX queue is recorded, else it
returns -1.  sk_tx_queue_recorded is no longer used so it can be
completely removed.

Signed-off-by: Tom Herbert <therbert@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-14 20:50:29 -07:00
..
9p kernel-wide: replace USHORT_MAX, SHORT_MAX and SHORT_MIN with USHRT_MAX, SHRT_MAX and SHRT_MIN 2010-05-25 08:07:02 -07:00
802 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
8021q net: deliver skbs on inactive slaves to exact matches 2010-06-10 22:23:34 -07:00
appletalk Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
atm net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
ax25 net: sk_sleep() helper 2010-04-20 16:37:13 -07:00
bluetooth Bluetooth: Update sec_level/auth_type for already existing connections 2010-07-08 20:35:31 -03:00
bridge bridge: Clear IPCB before possible entry into IP stack 2010-07-07 14:43:33 -07:00
caif caif: fix a couple range checks 2010-06-09 16:18:53 -07:00
can net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
core net: fix problem in reading sock TX queue 2010-07-14 20:50:29 -07:00
dcb include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
dccp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-25 16:59:51 -07:00
decnet net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
dsa dsa: Fix Kconfig dependencies. 2010-07-12 20:03:42 -07:00
econet include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
ethernet net: Inline skb_pull() in eth_type_trans(). 2010-05-02 02:21:44 -07:00
ieee802154 ieee802154: Fix possible NULL pointer dereference in wpan_phy_alloc 2010-05-23 23:11:07 -07:00
ipv4 rfs: call sock_rps_record_flow() in tcp_splice_read() 2010-07-14 14:45:15 -07:00
ipv6 xfrm: fix xfrm by MARK logic 2010-07-04 11:46:07 -07:00
ipx include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
irda net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
iucv Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-28 10:18:40 -07:00
key pfkey: add severity to printk 2010-05-17 23:23:13 -07:00
l2tp l2tp_eth: fix memory allocation 2010-04-23 16:37:33 -07:00
lapb include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
llc Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-12 00:05:35 -07:00
mac80211 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 2010-06-16 13:41:55 -07:00
netfilter ipvs: Add missing locking during connection table hashing and unhashing 2010-06-09 16:10:57 +02:00
netlabel net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
netlink netlink: Implment netlink_broadcast_filtered 2010-05-21 09:37:32 -07:00
netrom net: sk_sleep() helper 2010-04-20 16:37:13 -07:00
packet Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-21 01:14:25 -07:00
phonet Phonet: fix skb leak in pipe endpoint accept() 2010-07-08 21:45:34 -07:00
rds net/rds: Add missing mutex_unlock 2010-05-29 00:18:48 -07:00
rfkill Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-04-11 14:53:53 -07:00
rose net: sk_sleep() helper 2010-04-20 16:37:13 -07:00
rxrpc net: sock_def_readable() and friends RCU conversion 2010-05-01 15:00:15 -07:00
sched act_nat: not all of the ICMP packets need an IP header payload 2010-07-12 20:00:19 -07:00
sctp net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
sunrpc sunrpc: fix leak on error on socket xprt setup 2010-05-26 08:43:50 -04:00
tipc tipc: Reduce footprint by un-inlining tipc_msg_* routines 2010-05-12 23:02:29 -07:00
unix unix/garbage: kill copy of the skb queue walker 2010-05-03 15:39:58 -07:00
wanrouter
wimax Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 2010-05-20 21:04:44 -07:00
wireless cfg80211: add missing braces 2010-05-21 14:40:01 -04:00
x25 X25: Remove bkl in sockopts 2010-05-17 17:39:28 -07:00
xfrm xfrm: do not assume that template resolving always returns xfrms 2010-07-14 14:16:48 -07:00
compat.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
Kconfig net/sysfs: Fix the bitrot in network device kobject namespace support 2010-05-21 09:37:32 -07:00
Makefile l2tp: Split pppol2tp patch into separate l2tp and ppp parts 2010-04-03 14:56:02 -07:00
nonet.c
socket.c cls_cgroup: Store classid in struct sock 2010-05-24 00:12:34 -07:00
sysctl_net.c net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
TUNABLE