netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP=m

When the netprio_cgroup module is not loaded, net_prio_subsys_id
is -1, and so sock_update_prioidx() accesses cgroup_subsys array
with negative index subsys[-1].

Make the code resembles cls_cgroup code, which is bug free.

Origionally-authored-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/netprio_cgroup.h b/include/net/netprio_cgroup.h
index 7b2d43139c8e750e4b49ce6bf2244f12858a3211..d58fdec47597bccc095a9da28066bd6b67acfc2f 100644 (file)
--- a/include/net/netprio_cgroup.h
+++ b/include/net/netprio_cgroup.h
@@ -37,19 +37,51 @@ extern int net_prio_subsys_id;
 
 extern void sock_update_netprioidx(struct sock *sk);
 
-static inline struct cgroup_netprio_state
-               *task_netprio_state(struct task_struct *p)
+#if IS_BUILTIN(CONFIG_NETPRIO_CGROUP)
+
+static inline u32 task_netprioidx(struct task_struct *p)
 {
-#if IS_ENABLED(CONFIG_NETPRIO_CGROUP)
-       return container_of(task_subsys_state(p, net_prio_subsys_id),
-                           struct cgroup_netprio_state, css);
-#else
-       return NULL;
-#endif
+       struct cgroup_netprio_state *state;
+       u32 idx;
+
+       rcu_read_lock();
+       state = container_of(task_subsys_state(p, net_prio_subsys_id),
+                            struct cgroup_netprio_state, css);
+       idx = state->prioidx;
+       rcu_read_unlock();
+       return idx;
+}
+
+#elif IS_MODULE(CONFIG_NETPRIO_CGROUP)
+
+static inline u32 task_netprioidx(struct task_struct *p)
+{
+       struct cgroup_netprio_state *state;
+       int subsys_id;
+       u32 idx = 0;
+
+       rcu_read_lock();
+       subsys_id = rcu_dereference_index_check(net_prio_subsys_id,
+                                               rcu_read_lock_held());
+       if (subsys_id >= 0) {
+               state = container_of(task_subsys_state(p, subsys_id),
+                                    struct cgroup_netprio_state, css);
+               idx = state->prioidx;
+       }
+       rcu_read_unlock();
+       return idx;
 }
 
 #else
 
+static inline u32 task_netprioidx(struct task_struct *p)
+{
+       return 0;
+}
+
+#endif /* CONFIG_NETPRIO_CGROUP */
+
+#else
 #define sock_update_netprioidx(sk)
 #endif
 

diff --git a/net/core/sock.c b/net/core/sock.c
index 3e81fd2e3c75ca01ed972e98f3bc3f344fe5bfe6..02f8dfe320b771ee96ba3bb5bae52b2974608bd8 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1171,13 +1171,10 @@ EXPORT_SYMBOL(sock_update_classid);
 
 void sock_update_netprioidx(struct sock *sk)
 {
-       struct cgroup_netprio_state *state;
        if (in_interrupt())
                return;
-       rcu_read_lock();
-       state = task_netprio_state(current);
-       sk->sk_cgrp_prioidx = state ? state->prioidx : 0;
-       rcu_read_unlock();
+
+       sk->sk_cgrp_prioidx = task_netprioidx(current);
 }
 EXPORT_SYMBOL_GPL(sock_update_netprioidx);
 #endif