Re: [PATCH net] packet: avoid out of bounds read in round robin fanout

[Willem de Bruijn <willemb@google.com>]

On Tue, Jun 16, 2015 at 5:07 PM, Willem de Bruijn <willemb@google.com> wrote:
> From: Willem de Bruijn <willemb@google.com>
>
> PACKET_FANOUT_LB computes f->rr_cur such that it is modulo
> f->num_members. It returns the old value unconditionally, but
> f->num_members may have changed since the last store. This can be
> fixed with
>
>   -        return cur
>   +        return cur < num ? : 0;

Well, that test is bad. Should be return cur < num ? cur : 0. But the
patch is more concise, anyway.

>
> When modifying the logic, simplify it further by replacing the loop
> with an unconditional atomic increment.
>
> Fixes: dc99f600698d ("packet: Add fanout support.")
> Suggested-by: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Willem de Bruijn <willemb@google.com>