lkml.org 
[lkml]   [2013]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 007/104] fib_trie: remove potential out of bound access
    Date
    3.8.13.11 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit aab515d7c32a34300312416c50314e755ea6f765 ]

    AddressSanitizer [1] dynamic checker pointed a potential
    out of bound access in leaf_walk_rcu()

    We could allocate one more slot in tnode_new() to leave the prefetch()
    in-place but it looks not worth the pain.

    Bug added in commit 82cfbb008572b ("[IPV4] fib_trie: iterator recode")

    [1] :
    https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel

    Reported-by: Andrey Konovalov <andreyknvl@google.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/ipv4/fib_trie.c | 5 +----
    1 file changed, 1 insertion(+), 4 deletions(-)

    diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
    index 31d771c..c005f03 100644
    --- a/net/ipv4/fib_trie.c
    +++ b/net/ipv4/fib_trie.c
    @@ -71,7 +71,6 @@
    #include <linux/init.h>
    #include <linux/list.h>
    #include <linux/slab.h>
    -#include <linux/prefetch.h>
    #include <linux/export.h>
    #include <net/net_namespace.h>
    #include <net/ip.h>
    @@ -1773,10 +1772,8 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c)
    if (!c)
    continue;

    - if (IS_LEAF(c)) {
    - prefetch(rcu_dereference_rtnl(p->child[idx]));
    + if (IS_LEAF(c))
    return (struct leaf *) c;
    - }

    /* Rescan start scanning in new node */
    p = (struct tnode *) c;
    --
    1.8.1.2


    \
     
     \ /
      Last update: 2013-10-10 18:01    [W:4.033 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site