Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b73bc65 authored by Neil Horman's avatar Neil Horman Committed by David S. Miller
Browse files

netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP=m 



When the netprio_cgroup module is not loaded, net_prio_subsys_id
is -1, and so sock_update_prioidx() accesses cgroup_subsys array
with negative index subsys[-1].

Make the code resembles cls_cgroup code, which is bug free.

Origionally-authored-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: default avatarNeil Horman <nhorman@tuxdriver.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f5c38208

include/net/netprio_cgroup.h

+40 −8
Original line number Diff line number Diff line
@@ -37,19 +37,51 @@ extern int net_prio_subsys_id; 


extern void sock_update_netprioidx(struct sock *sk);



static inline struct cgroup_netprio_state

		*task_netprio_state(struct task_struct *p)

#if IS_BUILTIN(CONFIG_NETPRIO_CGROUP)



static inline u32 task_netprioidx(struct task_struct *p)

{

#if IS_ENABLED(CONFIG_NETPRIO_CGROUP)

	return container_of(task_subsys_state(p, net_prio_subsys_id),

	struct cgroup_netprio_state *state;

	u32 idx;



	rcu_read_lock();

	state = container_of(task_subsys_state(p, net_prio_subsys_id),

			     struct cgroup_netprio_state, css);

#else

	return NULL;

#endif

	idx = state->prioidx;

	rcu_read_unlock();

	return idx;

}



#elif IS_MODULE(CONFIG_NETPRIO_CGROUP)



static inline u32 task_netprioidx(struct task_struct *p)

{

	struct cgroup_netprio_state *state;

	int subsys_id;

	u32 idx = 0;



	rcu_read_lock();

	subsys_id = rcu_dereference_index_check(net_prio_subsys_id,

						rcu_read_lock_held());

	if (subsys_id >= 0) {

		state = container_of(task_subsys_state(p, subsys_id),

				     struct cgroup_netprio_state, css);

		idx = state->prioidx;

	}

	rcu_read_unlock();

	return idx;

}



#else



static inline u32 task_netprioidx(struct task_struct *p)

{

	return 0;

}



#endif /* CONFIG_NETPRIO_CGROUP */



#else

#define sock_update_netprioidx(sk)

#endif

net/core/sock.c

+2 −5
Original line number Diff line number Diff line
@@ -1171,13 +1171,10 @@ EXPORT_SYMBOL(sock_update_classid); 


void sock_update_netprioidx(struct sock *sk)

{

	struct cgroup_netprio_state *state;

	if (in_interrupt())

		return;

	rcu_read_lock();

	state = task_netprio_state(current);

	sk->sk_cgrp_prioidx = state ? state->prioidx : 0;

	rcu_read_unlock();



	sk->sk_cgrp_prioidx = task_netprioidx(current);

}

EXPORT_SYMBOL_GPL(sock_update_netprioidx);

#endif