From: John Fastabend <john.r.fastabend@intel.com>
To: davem@davemloft.net, gaofeng@cn.fujitsu.com, nhorman@tuxdriver.com
Cc: mark.d.rustad@intel.com, netdev@vger.kernel.org, eric.dumazet@gmail.com
Subject: [RFC PATCH] net: cgroup: null ptr dereference in netprio cgroup during init
Date: Tue, 17 Jul 2012 17:33:16 -0700 [thread overview]
Message-ID: <20120718003316.2979.49278.stgit@jf-dev1-dcblab> (raw)
When the netprio cgroup is built in the kernel cgroup_init will call
cgrp_create which eventually calls update_netdev_tables. This is
being called before do_initcalls() so a null ptr dereference occurs
on init_net.
This patch adds a check on init_net.count to verify the structure
has been initialized. The failure was introduced here,
commit ef209f15980360f6945873df3cd710c5f62f2a3e
Author: Gao feng <gaofeng@cn.fujitsu.com>
Date: Wed Jul 11 21:50:15 2012 +0000
net: cgroup: fix access the unallocated memory in netprio cgroup
Tested with ping with netprio_cgroup as a module and built in.
Marked RFC for now I think DaveM might have a reason why this needs
some improvement.
Reported-by: Mark Rustad <mark.d.rustad@intel.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
---
net/core/netprio_cgroup.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index b2e9caa..e9fd7fd 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -116,6 +116,9 @@ static int update_netdev_tables(void)
u32 max_len;
struct netprio_map *map;
+ if (!atomic_read(&init_net.count))
+ return ret;
+
rtnl_lock();
max_len = atomic_read(&max_prioidx) + 1;
for_each_netdev(&init_net, dev) {
next reply other threads:[~2012-07-18 0:48 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-18 0:33 John Fastabend [this message]
2012-07-18 1:59 ` [RFC PATCH] net: cgroup: null ptr dereference in netprio cgroup during init Gao feng
2012-07-18 5:50 ` John Fastabend
2012-07-18 7:58 ` Gao feng
2012-07-18 12:45 ` Neil Horman
2012-07-18 14:21 ` John Fastabend
2012-07-18 15:14 ` John Fastabend
2012-07-18 16:50 ` Neil Horman
2012-07-18 17:14 ` Neil Horman
2012-07-18 15:25 ` Neil Horman
2012-07-18 15:53 ` David Miller
2012-07-18 16:37 ` Neil Horman
2012-07-18 16:39 ` David Miller
2012-07-18 16:26 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120718003316.2979.49278.stgit@jf-dev1-dcblab \
--to=john.r.fastabend@intel.com \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=gaofeng@cn.fujitsu.com \
--cc=mark.d.rustad@intel.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.