lkml.org 
[lkml]   [2009]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 07/74] net: sk_prot_alloc() should not blindly overwrite memory
    2.6.30-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Eric Dumazet <eric.dumazet@gmail.com>

    [ Upstream commit e912b1142be8f1e2c71c71001dc992c6e5eb2ec1 ]

    Some sockets use SLAB_DESTROY_BY_RCU, and our RCU code correctness
    depends on sk->sk_nulls_node.next being always valid. A NULL
    value is not allowed as it might fault a lockless reader.

    Current sk_prot_alloc() implementation doesnt respect this hypothesis,
    calling kmem_cache_alloc() with __GFP_ZERO. Just call memset() around
    the forbidden field.

    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    net/core/sock.c | 19 +++++++++++++++++--
    1 file changed, 17 insertions(+), 2 deletions(-)

    --- a/net/core/sock.c
    +++ b/net/core/sock.c
    @@ -935,8 +935,23 @@ static struct sock *sk_prot_alloc(struct
    struct kmem_cache *slab;

    slab = prot->slab;
    - if (slab != NULL)
    - sk = kmem_cache_alloc(slab, priority);
    + if (slab != NULL) {
    + sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
    + if (!sk)
    + return sk;
    + if (priority & __GFP_ZERO) {
    + /*
    + * caches using SLAB_DESTROY_BY_RCU should let
    + * sk_node.next un-modified. Special care is taken
    + * when initializing object to zero.
    + */
    + if (offsetof(struct sock, sk_node.next) != 0)
    + memset(sk, 0, offsetof(struct sock, sk_node.next));
    + memset(&sk->sk_node.pprev, 0,
    + prot->obj_size - offsetof(struct sock,
    + sk_node.pprev));
    + }
    + }
    else
    sk = kmalloc(prot->obj_size, priority);




    \
     
     \ /
      Last update: 2009-08-13 22:27    [W:0.043 / U:0.424 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site