Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e65fcfd6 authored by Paul Menage's avatar Paul Menage Committed by David S. Miller
Browse files

cls_cgroup: read classid atomically in classifier 



Avoid reading the unsynchronized value cs->classid multiple times,
since it could change concurrently from non-zero to zero; this would
result in the classifier returning a positive result with a bogus
(zero) classid.

Signed-off-by: default avatarPaul Menage <menage@google.com>
Reviewed-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7682455e

net/sched/cls_cgroup.c

+11 −11
Original line number Diff line number Diff line
@@ -104,8 +104,7 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp, 
			       struct tcf_result *res)

{

	struct cls_cgroup_head *head = tp->root;

	struct cgroup_cls_state *cs;

	int ret = 0;

	u32 classid;



	/*

	 * Due to the nature of the classifier it is required to ignore all
@@ -121,17 +120,18 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp, 
		return -1;



	rcu_read_lock();

	cs = task_cls_state(current);

	if (cs->classid && tcf_em_tree_match(skb, &head->ematches, NULL)) {

		res->classid = cs->classid;

		res->class = 0;

		ret = tcf_exts_exec(skb, &head->exts, res);

	} else

		ret = -1;



	classid = task_cls_state(current)->classid;

	rcu_read_unlock();



	return ret;

	if (!classid)

		return -1;



	if (!tcf_em_tree_match(skb, &head->ematches, NULL))

		return -1;



	res->classid = classid;

	res->class = 0;

	return tcf_exts_exec(skb, &head->exts, res);

}



static unsigned long cls_cgroup_get(struct tcf_proto *tp, u32 handle)