github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
f98ca137c2
linux/net
History
Qi Zhang f98ca137c2 net: pktgen: use a consistent flow count 
pktgen_if_write() can update cflows while the packet generator thread is
inside mod_cur_headers(). The latter first tests cflows, but f_pick() then
reloads it when selecting a random flow.

This allows the following interleaving:

  CPU 0 (kpktgend)                 CPU 1 (proc write)
  if (pkt_dev->cflows) // 10
                                   pkt_dev->cflows = 0
  get_random_u32_below(pkt_dev->cflows)

get_random_u32_below(0) returns a full-width random value. Using that
value as an index into the fixed-size flows array causes an out-of-bounds
access. The kernel reported:

  BUG: unable to handle page fault for address: ffffc8fe2d2674bc
  #PF: supervisor read access in kernel mode
  Oops: Oops: 0000 [#1] SMP KASAN NOPTI
  CPU: 0 UID: 0 PID: 65 Comm: kpktgend_0
  RIP: 0010:mod_cur_headers+0x16f8/0x2840
  Call Trace:
   <TASK>
   pktgen_thread_worker+0x305a/0x6bc0
   kthread+0x2c6/0x3b0
   ret_from_fork+0x36e/0x5a0
   ret_from_fork_asm+0x1a/0x30
   </TASK>

Read cflows once at the start of mod_cur_headers(), pass the snapshot to
f_pick(), and use it for later flow-state decisions in the same packet.
Publish proc updates with WRITE_ONCE(). Flow selection then always uses a
nonzero count bounded by MAX_CFLOWS, while a concurrent update takes
effect on a later packet.

Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns)
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Qi Zhang <marsy12010123@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-17 12:50:51 -07:00
..
6lowpan net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
9p 9p: Add missing read barrier in virtio zero-copy path 2026-06-21 05:22:57 +00:00
802 appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
8021q vlan: defer real device state propagation to netdev_work 2026-06-25 10:18:40 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
batman-adv batman-adv: remove negative returns for batadv_send_skb_unicast 2026-08-05 10:00:16 +02:00
bluetooth Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept 2026-08-07 15:40:28 -04:00
bpf bpf: Fix partial copy of non-linear test_run output 2026-06-21 17:55:06 -07:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
can can: isotp: check register_netdevice_notifier() error in module init 2026-07-29 11:26:41 +02:00
ceph libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE 2026-07-23 20:29:42 +02:00
core net: pktgen: use a consistent flow count 2026-08-17 12:50:51 -07:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink devlink: add generic device max_sfs parameter 2026-08-11 18:06:30 -07:00
dns_resolver keys, dns: Drop unused NUL terminator from upayload->data 2026-08-10 16:20:42 -07:00
dsa net: dsa: drop explicit NULL comparisons 2026-08-14 13:57:27 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: tsconfig: reject zero-valued tx_type and rx_filter bitsets 2026-08-13 17:44:54 -07:00
handshake handshake: Require admin permission for DONE command 2026-06-12 15:45:44 -07:00
hsr net: hsr: allow PRP RedBox (interlink) creation 2026-07-27 17:46:41 -07:00
ieee802154 ieee802154: convert dgram getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-06-13 17:34:39 -07:00
ipv4 gre: fix ERSPAN o_flags race/corruption in xmit and fill_info 2026-08-14 12:57:44 -07:00
ipv6 gre: fix ERSPAN o_flags race/corruption in xmit and fill_info 2026-08-14 12:57:44 -07:00
iucv net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() 2026-07-21 13:36:35 -07:00
kcm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
key ipsec-2026-06-22 2026-06-23 16:22:24 -07:00
l2tp l2tp: send netlink notifications in the tunnel's net namespace 2026-08-13 17:33:31 -07:00
l3mdev
lapb treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-17 13:17:46 +02:00
mac80211 Quite a bunch more work, of note: 2026-08-06 12:39:11 -07:00
mac802154 mac802154: fix netdev use-after-free in beacon worker 2026-08-05 17:12:50 -07:00
mctp mctp: check register_netdevice_notifier() error in mctp_device_init() 2026-07-23 09:17:36 -07:00
mpls net: mpls: initialize rtm_tos in mpls_getroute() 2026-07-28 11:06:06 +02:00
mptcp mptcp: implemented OoO queue pruning 2026-08-11 18:35:38 -07:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-05 17:24:57 -07:00
netfilter netfilter pull request 26-08-10 2026-08-14 12:23:12 -07:00
netlabel Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-11 14:33:35 -07:00
netlink netlink: drop unneeded semicolon 2026-08-05 17:32:34 -07:00
nfc nfc: nci: uart: Constify struct tty_ldisc_ops 2026-06-11 20:21:32 +02:00
nsh
openvswitch netfilter pull request 26-08-10 2026-08-14 12:23:12 -07:00
packet af_packet: Don't send zero-byte data in tpacket_snd(). 2026-08-11 17:32:53 -07:00
phonet phonet: pep: convert getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-06-17 16:35:50 -07:00
psp psp: use unrcu_pointer() for the cmpxchg() on netdev psp_dev 2026-08-17 11:06:14 -07:00
qrtr net: qrtr: ns: Raise lookup limit to 128 2026-08-06 08:10:44 -07:00
rds net/rds: clear i_rx_lat_trace in rds_inc_path_init() 2026-08-13 12:53:14 +02:00
rfkill Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rxrpc rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() 2026-07-21 11:52:29 +02:00
sched net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
shaper net: shaper: add a note that we expect cap dumps to be tiny 2026-06-11 12:55:23 +02:00
smc net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc SUNRPC: pin upper rpc_clnt across the TLS connect_worker 2026-07-08 14:07:19 -04:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc tipc: read le->link under the node lock in tipc_node_link_down() 2026-08-11 15:50:22 +02:00
tls Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
unix Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-13 11:00:14 -07:00
vmw_vsock net: Const qualify network templated ctl_tables Arrays 2026-08-13 13:12:24 +02:00
wireless Quite a bunch more work, of note: 2026-08-06 12:39:11 -07:00
x25 net/x25: fix use-after-free of the socket by its timers 2026-07-30 18:46:45 -07:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
xfrm net: Const qualify ctl_tables that kmemdup unconditionally 2026-08-13 13:12:24 +02:00
compat.c net: Remove support for AIO on sockets 2026-05-29 14:05:30 +08:00
devres.c
Kconfig appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
Kconfig.debug
Makefile appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
socket.c Networking changes for 7.2. 2026-06-17 08:17:00 +01:00
sysctl_net.c net: enforce net sysctl registration 2026-08-13 13:12:21 +02:00