Skip to content

Commit

Permalink
netprio_cgroup: Fix obo in get_prioidx
Browse files Browse the repository at this point in the history
It was recently pointed out to me that the get_prioidx function sets a bit in
the prioidx map prior to checking to see if the index being set is out of
bounds.  This patch corrects that, avoiding the possiblity of us writing beyond
the end of the array

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
CC: Stanislaw Gruszka <sgruszka@redhat.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Neil Horman authored and David S. Miller committed Feb 4, 2012
1 parent 1715322 commit 5962b35
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions net/core/netprio_cgroup.c
Original file line number Diff line number Diff line change
Expand Up @@ -58,11 +58,12 @@ static int get_prioidx(u32 *prio)

spin_lock_irqsave(&prioidx_map_lock, flags);
prioidx = find_first_zero_bit(prioidx_map, sizeof(unsigned long) * PRIOIDX_SZ);
if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ) {
spin_unlock_irqrestore(&prioidx_map_lock, flags);
return -ENOSPC;
}
set_bit(prioidx, prioidx_map);
spin_unlock_irqrestore(&prioidx_map_lock, flags);
if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ)
return -ENOSPC;

atomic_set(&max_prioidx, prioidx);
*prio = prioidx;
return 0;
Expand Down

0 comments on commit 5962b35

Please sign in to comment.