From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:35810 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753626AbbIZSln (ORCPT ); Sat, 26 Sep 2015 14:41:43 -0400 Subject: Patch "net: graceful exit from netif_alloc_netdev_queues()" has been added to the 4.1-stable tree To: edumazet@google.com, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Sat, 26 Sep 2015 11:41:43 -0700 Message-ID: <144329290322260@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled net: graceful exit from netif_alloc_netdev_queues() to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-graceful-exit-from-netif_alloc_netdev_queues.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Sat Sep 26 11:13:07 PDT 2015 From: Eric Dumazet Date: Mon, 6 Jul 2015 17:13:26 +0200 Subject: net: graceful exit from netif_alloc_netdev_queues() From: Eric Dumazet [ Upstream commit d339727c2b1a10f25e6636670ab6e1841170e328 ] User space can crash kernel with ip link add ifb10 numtxqueues 100000 type ifb We must replace a BUG_ON() by proper test and return -EINVAL for crazy values. Fixes: 60877a32bce00 ("net: allow large number of tx queues") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/core/dev.c +++ b/net/core/dev.c @@ -6297,7 +6297,8 @@ static int netif_alloc_netdev_queues(str struct netdev_queue *tx; size_t sz = count * sizeof(*tx); - BUG_ON(count < 1 || count > 0xffff); + if (count < 1 || count > 0xffff) + return -EINVAL; tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT); if (!tx) { Patches currently in stable-queue which might be from edumazet@google.com are queue-4.1/udp-fix-dst-races-with-multicast-early-demux.patch queue-4.1/fq_codel-fix-a-use-after-free.patch queue-4.1/inet-fix-possible-request-socket-leak.patch queue-4.1/ipv6-lock-socket-in-ip6_datagram_connect.patch queue-4.1/net-fix-skb-csum-races-when-peeking.patch queue-4.1/inet-fix-races-with-reqsk-timers.patch queue-4.1/net-graceful-exit-from-netif_alloc_netdev_queues.patch queue-4.1/bridge-fix-potential-crash-in-__netdev_pick_tx.patch queue-4.1/inet-frags-fix-defragmented-packet-s-ip-header-for-af_packet.patch