diff options
| author | Chetan Loke <loke.chetan@gmail.com> | 2011-07-14 17:36:33 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-07-14 17:36:33 +0200 |
| commit | cc9f01b246ca8e4fa245991840b8076394f86707 (patch) | |
| tree | fb362018297a83c9c288a000893d7dbb88a3aead /net/packet | |
| parent | Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/ne... (diff) | |
| download | linux-cc9f01b246ca8e4fa245991840b8076394f86707.tar.xz linux-cc9f01b246ca8e4fa245991840b8076394f86707.zip | |
af-packet: fix - avoid reading stale data
Currently we flush tp_status and then flush the remainder of the header+payload.
tp_status should be flushed in the end to avoid stale data being read by user-space.
Incorrectly re-ordered barriers in v1.
Signed-off-by: Chetan Loke <loke.chetan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/packet')
| -rw-r--r-- | net/packet/af_packet.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index d2294ad1a895..c698cec0a445 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1129,7 +1129,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, else sll->sll_ifindex = dev->ifindex; - __packet_set_status(po, h.raw, status); smp_mb(); #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 { @@ -1138,8 +1137,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, end = (u8 *)PAGE_ALIGN((unsigned long)h.raw + macoff + snaplen); for (start = h.raw; start < end; start += PAGE_SIZE) flush_dcache_page(pgv_to_page(start)); + smp_wmb(); } #endif + __packet_set_status(po, h.raw, status); sk->sk_data_ready(sk, 0); |