* [PATCH] netprio_cgroup: Fix obo in get_prioidx
@ 2012-02-03 15:18 Neil Horman
2012-02-04 21:31 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Neil Horman @ 2012-02-03 15:18 UTC (permalink / raw)
To: netdev; +Cc: Neil Horman, Stanislaw Gruszka, David S. Miller
It was recently pointed out to me that the get_prioidx function sets a bit in
the prioidx map prior to checking to see if the index being set is out of
bounds. This patch corrects that, avoiding the possiblity of us writing beyond
the end of the array
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
CC: Stanislaw Gruszka <sgruszka@redhat.com>
CC: "David S. Miller" <davem@davemloft.net>
---
net/core/netprio_cgroup.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 3a9fd48..9ae183a 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -58,11 +58,12 @@ static int get_prioidx(u32 *prio)
spin_lock_irqsave(&prioidx_map_lock, flags);
prioidx = find_first_zero_bit(prioidx_map, sizeof(unsigned long) * PRIOIDX_SZ);
+ if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ) {
+ spin_unlock_irqrestore(&prioidx_map_lock, flags);
+ return -ENOSPC;
+ }
set_bit(prioidx, prioidx_map);
spin_unlock_irqrestore(&prioidx_map_lock, flags);
- if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ)
- return -ENOSPC;
-
atomic_set(&max_prioidx, prioidx);
*prio = prioidx;
return 0;
--
1.7.7.6
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] netprio_cgroup: Fix obo in get_prioidx
2012-02-03 15:18 [PATCH] netprio_cgroup: Fix obo in get_prioidx Neil Horman
@ 2012-02-04 21:31 ` David Miller
2012-02-04 21:42 ` Neil Horman
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2012-02-04 21:31 UTC (permalink / raw)
To: nhorman; +Cc: netdev, sgruszka
From: Neil Horman <nhorman@tuxdriver.com>
Date: Fri, 3 Feb 2012 10:18:43 -0500
> It was recently pointed out to me that the get_prioidx function sets a bit in
> the prioidx map prior to checking to see if the index being set is out of
> bounds. This patch corrects that, avoiding the possiblity of us writing beyond
> the end of the array
>
> Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
> Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
Applied and queued up for -stable, thanks Neil.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] netprio_cgroup: Fix obo in get_prioidx
2012-02-04 21:31 ` David Miller
@ 2012-02-04 21:42 ` Neil Horman
0 siblings, 0 replies; 3+ messages in thread
From: Neil Horman @ 2012-02-04 21:42 UTC (permalink / raw)
To: David Miller; +Cc: netdev, sgruszka
On Sat, Feb 04, 2012 at 04:31:00PM -0500, David Miller wrote:
> From: Neil Horman <nhorman@tuxdriver.com>
> Date: Fri, 3 Feb 2012 10:18:43 -0500
>
> > It was recently pointed out to me that the get_prioidx function sets a bit in
> > the prioidx map prior to checking to see if the index being set is out of
> > bounds. This patch corrects that, avoiding the possiblity of us writing beyond
> > the end of the array
> >
> > Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
> > Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
>
> Applied and queued up for -stable, thanks Neil.
>
>
Thanks Dave!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-02-04 21:42 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-03 15:18 [PATCH] netprio_cgroup: Fix obo in get_prioidx Neil Horman
2012-02-04 21:31 ` David Miller
2012-02-04 21:42 ` Neil Horman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).