mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 03:10:12 +00:00
net: use skb_to_full_sk() in skb_update_prio()
Andrei Vagin reported a KASAN: slab-out-of-bounds error in
skb_update_prio()
Since SYNACK might be attached to a request socket, we need to
get back to the listener socket.
Since this listener is manipulated without locks, add const
qualifiers to sock_cgroup_prioidx() so that the const can also
be used in skb_update_prio()
Also add the const qualifier to sock_cgroup_classid() for consistency.
Fixes: ca6fb06518
("tcp: attach SYNACK messages to request sockets instead of listener")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
f89782c2d1
commit
4dcb31d464
2 changed files with 17 additions and 9 deletions
|
@ -755,13 +755,13 @@ struct sock_cgroup_data {
|
|||
* updaters and return part of the previous pointer as the prioidx or
|
||||
* classid. Such races are short-lived and the result isn't critical.
|
||||
*/
|
||||
static inline u16 sock_cgroup_prioidx(struct sock_cgroup_data *skcd)
|
||||
static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd)
|
||||
{
|
||||
/* fallback to 1 which is always the ID of the root cgroup */
|
||||
return (skcd->is_data & 1) ? skcd->prioidx : 1;
|
||||
}
|
||||
|
||||
static inline u32 sock_cgroup_classid(struct sock_cgroup_data *skcd)
|
||||
static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd)
|
||||
{
|
||||
/* fallback to 0 which is the unconfigured default classid */
|
||||
return (skcd->is_data & 1) ? skcd->classid : 0;
|
||||
|
|
|
@ -3278,15 +3278,23 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
|
|||
#if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)
|
||||
static void skb_update_prio(struct sk_buff *skb)
|
||||
{
|
||||
struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);
|
||||
const struct netprio_map *map;
|
||||
const struct sock *sk;
|
||||
unsigned int prioidx;
|
||||
|
||||
if (!skb->priority && skb->sk && map) {
|
||||
unsigned int prioidx =
|
||||
sock_cgroup_prioidx(&skb->sk->sk_cgrp_data);
|
||||
if (skb->priority)
|
||||
return;
|
||||
map = rcu_dereference_bh(skb->dev->priomap);
|
||||
if (!map)
|
||||
return;
|
||||
sk = skb_to_full_sk(skb);
|
||||
if (!sk)
|
||||
return;
|
||||
|
||||
if (prioidx < map->priomap_len)
|
||||
skb->priority = map->priomap[prioidx];
|
||||
}
|
||||
prioidx = sock_cgroup_prioidx(&sk->sk_cgrp_data);
|
||||
|
||||
if (prioidx < map->priomap_len)
|
||||
skb->priority = map->priomap[prioidx];
|
||||
}
|
||||
#else
|
||||
#define skb_update_prio(skb)
|
||||
|
|
Loading…
Reference in a new issue