path: root/net/ipv6/ip6_output.c
diff options
authorEric Dumazet <>2015-03-11 18:42:02 -0700
committerDavid S. Miller <>2015-03-11 23:51:18 -0400
commitc29390c6dfeee0944ac6b5610ebbe403944378fc (patch)
treebefe951b043be948957abb1db65cee36dd7a379b /net/ipv6/ip6_output.c
parentc8a4d29988edb0db9ee80669f2e5e21bd9f7e0d0 (diff)
xps: must clear sender_cpu before forwarding
John reported that my previous commit added a regression on his router. This is because sender_cpu & napi_id share a common location, so get_xps_queue() can see garbage and perform an out of bound access. We need to make sure sender_cpu is cleared before doing the transmit, otherwise any NIC busy poll enabled (skb_mark_napi_id()) can trigger this bug. Signed-off-by: Eric Dumazet <> Reported-by: John <> Bisected-by: John <> Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") Signed-off-by: David S. Miller <>
Diffstat (limited to 'net/ipv6/ip6_output.c')
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0a04a37305d5..7e80b61b51ff 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
static inline int ip6_forward_finish(struct sk_buff *skb)
+ skb_sender_cpu_clear(skb);
return dst_output(skb);