[natty CVE 1/1] bonding: Incorrect TX queue offset

[Stefan Bader]

On 06.06.2011 12:35, Andy Whitcroft wrote:
> From: Phil Oester<kernel at linuxace.com>
>
> When packets come in from a device with>= 16 receive queues
> headed out a bonding interface, syslog gets filled with this:
>
>      kernel: bond0 selects TX queue 16, but real number of TX queues is 16
>
> because queue_mapping is offset by 1.  Adjust return value
> to account for the offset.
>
> This is a revision of my earlier patch (which did not use the
> skb_rx_queue_* helpers - thanks to Ben for the suggestion).
> Andy submitted a similar patch which emits a pr_warning on
> invalid queue selection, but I believe the log spew is
> not useful.  We can revisit that question in the future,
> but in the interim I believe fixing the core problem is
> worthwhile.
>
> Signed-off-by: Phil Oester<kernel at linuxace.com>
> Signed-off-by: Andy Gospodarek<andy at greyhouse.net>
> Signed-off-by: David S. Miller<davem at davemloft.net>
>
> (cherry picked from commit fd0e435b0fe85622f167b84432552885a4856ac8)
> CVE-2011-1581
> BugLink: http://bugs.launchpad.net/bugs/792312
> Signed-off-by: Andy Whitcroft<apw at canonical.com>
> ---
>   drivers/net/bonding/bond_main.c |   11 +++++++++--
>   1 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 163e0b0..e68eaef 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -4537,11 +4537,18 @@ static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
>   {
>   	/*
>   	 * This helper function exists to help dev_pick_tx get the correct
> -	 * destination queue.  Using a helper function skips the a call to
> +	 * destination queue.  Using a helper function skips a call to
>   	 * skb_tx_hash and will put the skbs in the queue we expect on their
>   	 * way down to the bonding driver.
>   	 */
> -	return skb->queue_mapping;
> +	u16 txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
> +
> +	if (unlikely(txq>= dev->real_num_tx_queues)) {
> +		do
> +			txq -= dev->real_num_tx_queues;
> +		while (txq>= dev->real_num_tx_queues);
> +	}
> +	return txq;
>   }
>
>   static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)

Acked-by: Stefan Bader <stefan.bader at canonical.com>

(though more for being clean cherry pick, rather than clearness)