Patch "net: graceful exit from netif_alloc_netdev_queues()" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

net: graceful exit from netif_alloc_netdev_queues()

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-graceful-exit-from-netif_alloc_netdev_queues.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Mon, 6 Jul 2015 17:13:26 +0200
Subject: net: graceful exit from netif_alloc_netdev_queues()

From: Eric Dumazet <[email protected]>

[ Upstream commit d339727c2b1a10f25e6636670ab6e1841170e328 ]

User space can crash kernel with

ip link add ifb10 numtxqueues 100000 type ifb

We must replace a BUG_ON() by proper test and return -EINVAL for crazy values.

---
 net/core/dev.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -5951,7 +5951,8 @@ static int netif_alloc_netdev_queues(str
 	struct netdev_queue *tx;
 	size_t sz = count * sizeof(*tx);
 
-	BUG_ON(count < 1 || count > 0xffff);
+	if (count < 1 || count > 0xffff)
+		return -EINVAL;
 
 	tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
 	if (!tx) {

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/udp-fix-dst-races-with-multicast-early-demux.patch queue-3.14/ipv6-lock-socket-in-ip6_datagram_connect.patch queue-3.14/net-fix-skb-csum-races-when-peeking.patch queue-3.14/net-graceful-exit-from-netif_alloc_netdev_queues.patch queue-3.14/inet-frags-fix-defragmented-packet-s-ip-header-for-af_packet.patch