This is a note to let you know that I've just added the patch titled

    net-sched: sch_cbq: avoid infinite loop

to the 3.5-stable tree which can be found at:
    
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-sch_cbq-avoid-infinite-loop.patch
and it can be found in the queue-3.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.


>From 59ccff67a37eab1af67574467ed73d75930978d0 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <[email protected]>
Date: Tue, 11 Sep 2012 13:11:12 +0000
Subject: net-sched: sch_cbq: avoid infinite loop


From: Eric Dumazet <[email protected]>

[ Upstream commit bdfc87f7d1e253e0a61e2fc6a75ea9d76f7fc03a ]

Its possible to setup a bad cbq configuration leading to
an infinite loop in cbq_classify()

DEV_OUT=eth0
ICMP="match ip protocol 1 0xff"
U32="protocol ip u32"
DST="match ip dst"
tc qdisc add dev $DEV_OUT root handle 1: cbq avpkt 1000 \
        bandwidth 100mbit
tc class add dev $DEV_OUT parent 1: classid 1:1 cbq \
        rate 512kbit allot 1500 prio 5 bounded isolated
tc filter add dev $DEV_OUT parent 1: prio 3 $U32 \
        $ICMP $DST 192.168.3.234 flowid 1:

Reported-by: Denys Fedoryschenko <[email protected]>
Tested-by: Denys Fedoryschenko <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
 net/sched/sch_cbq.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -250,10 +250,11 @@ cbq_classify(struct sk_buff *skb, struct
                        else if ((cl = defmap[res.classid & TC_PRIO_MAX]) == 
NULL)
                                cl = defmap[TC_PRIO_BESTEFFORT];
 
-                       if (cl == NULL || cl->level >= head->level)
+                       if (cl == NULL)
                                goto fallback;
                }
-
+               if (cl->level >= head->level)
+                       goto fallback;
 #ifdef CONFIG_NET_CLS_ACT
                switch (result) {
                case TC_ACT_QUEUED:


Patches currently in stable-queue which might be from [email protected] are

queue-3.5/bnx2x-fix-rx-checksum-validation-for-ipv6.patch
queue-3.5/ipv6-mip6-fix-mip6_mh_filter.patch
queue-3.5/l2tp-fix-a-typo-in-l2tp_eth_dev_recv.patch
queue-3.5/net-guard-tcp_set_keepalive-to-tcp-sockets.patch
queue-3.5/net-sched-sch_cbq-avoid-infinite-loop.patch
queue-3.5/net-small-bug-on-rxhash-calculation.patch
queue-3.5/ipv6-raw-fix-icmpv6_filter.patch
queue-3.5/ipv4-raw-fix-icmp_filter.patch
queue-3.5/tcp-fix-regression-in-urgent-data-handling.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to