• Gao feng's avatar
    net: cgroup: fix access the unallocated memory in netprio cgroup · ef209f15
    Gao feng authored
    there are some out of bound accesses in netprio cgroup.
    
    now before accessing the dev->priomap.priomap array,we only check
    if the dev->priomap exist.and because we don't want to see
    additional bound checkings in fast path, so we should make sure
    that dev->priomap is null or array size of dev->priomap.priomap
    is equal to max_prioidx + 1;
    
    so in write_priomap logic,we should call extend_netdev_table when
    dev->priomap is null and dev->priomap.priomap_len < max_len.
    and in cgrp_create->update_netdev_tables logic,we should call
    extend_netdev_table only when dev->priomap exist and
    dev->priomap.priomap_len < max_len.
    
    and it's not needed to call update_netdev_tables in write_priomap,
    we can only allocate the net device's priomap which we change through
    net_prio.ifpriomap.
    
    this patch also add a return value for update_netdev_tables &
    extend_netdev_table, so when new_priomap is allocated failed,
    write_priomap will stop to access the priomap,and return -ENOMEM
    back to the userspace to tell the user what happend.
    
    Change From v3:
    1. add rtnl protect when reading max_prioidx in write_priomap.
    
    2. only call extend_netdev_table when map->priomap_len < max_len,
       this will make sure array size of dev->map->priomap always
       bigger than any prioidx.
    
    3. add a function write_update_netdev_table to make codes clear.
    
    Change From v2:
    1. protect extend_netdev_table by RTNL.
    2. when extend_netdev_table failed,call dev_put to reduce device's refcount.
    Signed-off-by: default avatarGao feng <gaofeng@cn.fujitsu.com>
    Cc: Neil Horman <nhorman@tuxdriver.com>
    Cc: Eric Dumazet <edumazet@google.com>
    Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ef209f15
netprio_cgroup.c 7.86 KB