Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28984ba0 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

net: use skb_to_full_sk() in skb_update_prio() 




[ Upstream commit 4dcb31d4649df36297296b819437709f5407059c ]

Andrei Vagin reported a KASAN: slab-out-of-bounds error in
skb_update_prio()

Since SYNACK might be attached to a request socket, we need to
get back to the listener socket.
Since this listener is manipulated without locks, add const
qualifiers to sock_cgroup_prioidx() so that the const can also
be used in skb_update_prio()

Also add the const qualifier to sock_cgroup_classid() for consistency.

Fixes: ca6fb065 ("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarAndrei Vagin <avagin@virtuozzo.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e7d79566

include/linux/cgroup-defs.h

+2 −2
Original line number Diff line number Diff line
@@ -609,13 +609,13 @@ struct sock_cgroup_data { 
 * updaters and return part of the previous pointer as the prioidx or

 * classid.  Such races are short-lived and the result isn't critical.

 */

static inline u16 sock_cgroup_prioidx(struct sock_cgroup_data *skcd)

static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd)

{

	/* fallback to 1 which is always the ID of the root cgroup */

	return (skcd->is_data & 1) ? skcd->prioidx : 1;

}



static inline u32 sock_cgroup_classid(struct sock_cgroup_data *skcd)

static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd)

{

	/* fallback to 0 which is the unconfigured default classid */

	return (skcd->is_data & 1) ? skcd->classid : 0;

net/core/dev.c

+15 −7
Original line number Diff line number Diff line
@@ -3179,16 +3179,24 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q, 
#if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)

static void skb_update_prio(struct sk_buff *skb)

{

	struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);

	const struct netprio_map *map;

	const struct sock *sk;

	unsigned int prioidx;



	if (!skb->priority && skb->sk && map) {

		unsigned int prioidx =

			sock_cgroup_prioidx(&skb->sk->sk_cgrp_data);

	if (skb->priority)

		return;

	map = rcu_dereference_bh(skb->dev->priomap);

	if (!map)

		return;

	sk = skb_to_full_sk(skb);

	if (!sk)

		return;



	prioidx = sock_cgroup_prioidx(&sk->sk_cgrp_data);



	if (prioidx < map->priomap_len)

		skb->priority = map->priomap[prioidx];

}

}

#else

#define skb_update_prio(skb)

#endif