From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754610AbbHEVxR (ORCPT ); Wed, 5 Aug 2015 17:53:17 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:38833 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754467AbbHEVur (ORCPT ); Wed, 5 Aug 2015 17:50:47 -0400 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Eric Dumazet , "David S. Miller" , Kamal Mostafa Subject: [PATCH 3.19.y-ckt 103/107] net: graceful exit from netif_alloc_netdev_queues() Date: Wed, 5 Aug 2015 14:49:35 -0700 Message-Id: <1438811379-384-104-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1438811379-384-1-git-send-email-kamal@canonical.com> References: <1438811379-384-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.19 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.19.8-ckt5 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet commit d339727c2b1a10f25e6636670ab6e1841170e328 upstream. User space can crash kernel with ip link add ifb10 numtxqueues 100000 type ifb We must replace a BUG_ON() by proper test and return -EINVAL for crazy values. Fixes: 60877a32bce00 ("net: allow large number of tx queues") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Kamal Mostafa --- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index 3638a78..9c14e87 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -6189,7 +6189,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev) struct netdev_queue *tx; size_t sz = count * sizeof(*tx); - BUG_ON(count < 1 || count > 0xffff); + if (count < 1 || count > 0xffff) + return -EINVAL; tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT); if (!tx) { -- 1.9.1