[PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[Gao feng]

there are some out of bound accesses in netprio cgroup.

now before accessing the dev->priomap.priomap array,we only check
if the dev->priomap exist.and because we don't want to see
additional bound checkings in fast path, so we should make sure
that dev->priomap is null or array size of dev->priomap.priomap
is equal to max_prioidx + 1;

so in write_priomap logic,we should call extend_netdev_table when
dev->priomap is null and dev->priomap.priomap_len < max_len.
and in cgrp_create->update_netdev_tables logic,we should call
extend_netdev_table only when dev->priomap exist and
dev->priomap.priomap_len < max_len.

and it's not needed to call update_netdev_tables in write_priomap,
we can only allocate the net device's priomap which we change through
net_prio.ifpriomap.

this patch also add a return value for update_netdev_tables &
extend_netdev_table, so when new_priomap is allocated failed,
write_priomap will stop to access the priomap,and return -ENOMEM
back to the userspace to tell the user what happend.

Change From v3:
1. add rtnl protect when reading max_prioidx in write_priomap.

2. only call extend_netdev_table when map->priomap_len < max_len,
   this will make sure array size of dev->map->priomap always
   bigger than any prioidx.

3. add a function write_update_netdev_table to make codes clear.

Change From v2:
1. protect extend_netdev_table by RTNL.
2. when extend_netdev_table failed,call dev_put to reduce device's refcount.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Eric Dumazet <edumazet@google.com>
---
 net/core/netprio_cgroup.c |   71 ++++++++++++++++++++++++++++++++++-----------
 1 files changed, 54 insertions(+), 17 deletions(-)

diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index aa907ed..9b17d54 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -65,7 +65,7 @@ static void put_prioidx(u32 idx)
 	spin_unlock_irqrestore(&prioidx_map_lock, flags);
 }
 
-static void extend_netdev_table(struct net_device *dev, u32 new_len)
+static int extend_netdev_table(struct net_device *dev, u32 new_len)
 {
 	size_t new_size = sizeof(struct netprio_map) +
 			   ((sizeof(u32) * new_len));
@@ -77,7 +77,7 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
 
 	if (!new_priomap) {
 		pr_warn("Unable to alloc new priomap!\n");
-		return;
+		return -ENOMEM;
 	}
 
 	for (i = 0;
@@ -90,46 +90,79 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
 	rcu_assign_pointer(dev->priomap, new_priomap);
 	if (old_priomap)
 		kfree_rcu(old_priomap, rcu);
+	return 0;
 }
 
-static void update_netdev_tables(void)
+static int write_update_netdev_table(struct net_device *dev)
 {
+	int ret = 0;
+	u32 max_len;
+	struct netprio_map *map;
+
+	rtnl_lock();
+	max_len = atomic_read(&max_prioidx) + 1;
+	map = rtnl_dereference(dev->priomap);
+	if (!map || map->priomap_len < max_len)
+		ret = extend_netdev_table(dev, max_len);
+	rtnl_unlock();
+
+	return ret;
+}
+
+static int update_netdev_tables(void)
+{
+	int ret = 0;
 	struct net_device *dev;
-	u32 max_len = atomic_read(&max_prioidx) + 1;
+	u32 max_len;
 	struct netprio_map *map;
 
 	rtnl_lock();
+	max_len = atomic_read(&max_prioidx) + 1;
 	for_each_netdev(&init_net, dev) {
 		map = rtnl_dereference(dev->priomap);
-		if ((!map) ||
-		    (map->priomap_len < max_len))
-			extend_netdev_table(dev, max_len);
+		/*
+		 * don't allocate priomap if we didn't
+		 * change net_prio.ifpriomap (map == NULL),
+		 * this will speed up skb_update_prio.
+		 */
+		if (map && map->priomap_len < max_len) {
+			ret = extend_netdev_table(dev, max_len);
+			if (ret < 0)
+				break;
+		}
 	}
 	rtnl_unlock();
+	return ret;
 }
 
 static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
 {
 	struct cgroup_netprio_state *cs;
-	int ret;
+	int ret = -EINVAL;
 
 	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
 	if (!cs)
 		return ERR_PTR(-ENOMEM);
 
-	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
-		kfree(cs);
-		return ERR_PTR(-EINVAL);
-	}
+	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
+		goto out;
 
 	ret = get_prioidx(&cs->prioidx);
-	if (ret != 0) {
+	if (ret < 0) {
 		pr_warn("No space in priority index array\n");
-		kfree(cs);
-		return ERR_PTR(ret);
+		goto out;
+	}
+
+	ret = update_netdev_tables();
+	if (ret < 0) {
+		put_prioidx(cs->prioidx);
+		goto out;
 	}
 
 	return &cs->css;
+out:
+	kfree(cs);
+	return ERR_PTR(ret);
 }
 
 static void cgrp_destroy(struct cgroup *cgrp)
@@ -221,13 +254,17 @@ static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
 	if (!dev)
 		goto out_free_devname;
 
-	update_netdev_tables();
-	ret = 0;
+	ret = write_update_netdev_table(dev);
+	if (ret < 0)
+		goto out_put_dev;
+
 	rcu_read_lock();
 	map = rcu_dereference(dev->priomap);
 	if (map)
 		map->priomap[prioidx] = priority;
 	rcu_read_unlock();
+
+out_put_dev:
 	dev_put(dev);
 
 out_free_devname:
-- 
1.7.7.6

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[Neil Horman]

On Thu, Jul 12, 2012 at 03:50:15PM +0800, Gao feng wrote:
> there are some out of bound accesses in netprio cgroup.
> 
> now before accessing the dev->priomap.priomap array,we only check
> if the dev->priomap exist.and because we don't want to see
> additional bound checkings in fast path, so we should make sure
> that dev->priomap is null or array size of dev->priomap.priomap
> is equal to max_prioidx + 1;
> 
> so in write_priomap logic,we should call extend_netdev_table when
> dev->priomap is null and dev->priomap.priomap_len < max_len.
> and in cgrp_create->update_netdev_tables logic,we should call
> extend_netdev_table only when dev->priomap exist and
> dev->priomap.priomap_len < max_len.
> 
> and it's not needed to call update_netdev_tables in write_priomap,
> we can only allocate the net device's priomap which we change through
> net_prio.ifpriomap.
> 
> this patch also add a return value for update_netdev_tables &
> extend_netdev_table, so when new_priomap is allocated failed,
> write_priomap will stop to access the priomap,and return -ENOMEM
> back to the userspace to tell the user what happend.
> 
> Change From v3:
> 1. add rtnl protect when reading max_prioidx in write_priomap.
> 
> 2. only call extend_netdev_table when map->priomap_len < max_len,
>    this will make sure array size of dev->map->priomap always
>    bigger than any prioidx.
> 
> 3. add a function write_update_netdev_table to make codes clear.
> 
> Change From v2:
> 1. protect extend_netdev_table by RTNL.
> 2. when extend_netdev_table failed,call dev_put to reduce device's refcount.
> 
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> Cc: Neil Horman <nhorman@tuxdriver.com>
> Cc: Eric Dumazet <edumazet@google.com>

Thank you Gao.
Acked-by: Neil Horman <nhorman@tuxdriver.com>

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[David Miller]

From: Neil Horman <nhorman@tuxdriver.com>
Date: Thu, 12 Jul 2012 06:56:11 -0400

> On Thu, Jul 12, 2012 at 03:50:15PM +0800, Gao feng wrote:
>> there are some out of bound accesses in netprio cgroup.
 ...
>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> 
> Acked-by: Neil Horman <nhorman@tuxdriver.com>
> 

Applied to 'net', thanks.

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[John Fastabend]

On 7/12/2012 12:50 AM, Gao feng wrote:
> there are some out of bound accesses in netprio cgroup.
>
> now before accessing the dev->priomap.priomap array,we only check
> if the dev->priomap exist.and because we don't want to see
> additional bound checkings in fast path, so we should make sure
> that dev->priomap is null or array size of dev->priomap.priomap
> is equal to max_prioidx + 1;
>
> so in write_priomap logic,we should call extend_netdev_table when
> dev->priomap is null and dev->priomap.priomap_len < max_len.
> and in cgrp_create->update_netdev_tables logic,we should call
> extend_netdev_table only when dev->priomap exist and
> dev->priomap.priomap_len < max_len.
>
> and it's not needed to call update_netdev_tables in write_priomap,
> we can only allocate the net device's priomap which we change through
> net_prio.ifpriomap.
>
> this patch also add a return value for update_netdev_tables &
> extend_netdev_table, so when new_priomap is allocated failed,
> write_priomap will stop to access the priomap,and return -ENOMEM
> back to the userspace to tell the user what happend.
>
> Change From v3:
> 1. add rtnl protect when reading max_prioidx in write_priomap.
>
> 2. only call extend_netdev_table when map->priomap_len < max_len,
>     this will make sure array size of dev->map->priomap always
>     bigger than any prioidx.
>
> 3. add a function write_update_netdev_table to make codes clear.
>
> Change From v2:
> 1. protect extend_netdev_table by RTNL.
> 2. when extend_netdev_table failed,call dev_put to reduce device's refcount.
>
> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> Cc: Neil Horman <nhorman@tuxdriver.com>
> Cc: Eric Dumazet <edumazet@google.com>
> ---
>   net/core/netprio_cgroup.c |   71 ++++++++++++++++++++++++++++++++++-----------
>   1 files changed, 54 insertions(+), 17 deletions(-)
>

[...]

> +
> +static int update_netdev_tables(void)
> +{
> +	int ret = 0;
>   	struct net_device *dev;
> -	u32 max_len = atomic_read(&max_prioidx) + 1;
> +	u32 max_len;
>   	struct netprio_map *map;


need to check if net subsystem is initialized before we try
to use it here...

	if (some_check)     -> need to lookup what this check is
		return ret;

>
>   	rtnl_lock();
> +	max_len = atomic_read(&max_prioidx) + 1;
>   	for_each_netdev(&init_net, dev) {
>   		map = rtnl_dereference(dev->priomap);
> -		if ((!map) ||
> -		    (map->priomap_len < max_len))
> -			extend_netdev_table(dev, max_len);
> +		/*
> +		 * don't allocate priomap if we didn't
> +		 * change net_prio.ifpriomap (map == NULL),
> +		 * this will speed up skb_update_prio.
> +		 */
> +		if (map && map->priomap_len < max_len) {
> +			ret = extend_netdev_table(dev, max_len);
> +			if (ret < 0)
> +				break;
> +		}
>   	}
>   	rtnl_unlock();
> +	return ret;
>   }
>
>   static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
>   {
>   	struct cgroup_netprio_state *cs;
> -	int ret;
> +	int ret = -EINVAL;
>
>   	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
>   	if (!cs)
>   		return ERR_PTR(-ENOMEM);
>
> -	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
> -		kfree(cs);
> -		return ERR_PTR(-EINVAL);
> -	}
> +	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
> +		goto out;
>
>   	ret = get_prioidx(&cs->prioidx);
> -	if (ret != 0) {
> +	if (ret < 0) {
>   		pr_warn("No space in priority index array\n");
> -		kfree(cs);
> -		return ERR_PTR(ret);
> +		goto out;
> +	}
> +
> +	ret = update_netdev_tables();
> +	if (ret < 0) {
> +		put_prioidx(cs->prioidx);
> +		goto out;
>   	}

Gao,

This introduces a null ptr dereference when netprio_cgroup is built
into the kernel because update_netdev_tables() depends on init_net.
However cgrp_create is being called by cgroup_init before
do_initcalls() is called and before net_dev_init().

.John

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[Neil Horman]

On Tue, Jul 17, 2012 at 01:47:25PM -0700, John Fastabend wrote:
> On 7/12/2012 12:50 AM, Gao feng wrote:
> >there are some out of bound accesses in netprio cgroup.
> >
> >now before accessing the dev->priomap.priomap array,we only check
> >if the dev->priomap exist.and because we don't want to see
> >additional bound checkings in fast path, so we should make sure
> >that dev->priomap is null or array size of dev->priomap.priomap
> >is equal to max_prioidx + 1;
> >
> >so in write_priomap logic,we should call extend_netdev_table when
> >dev->priomap is null and dev->priomap.priomap_len < max_len.
> >and in cgrp_create->update_netdev_tables logic,we should call
> >extend_netdev_table only when dev->priomap exist and
> >dev->priomap.priomap_len < max_len.
> >
> >and it's not needed to call update_netdev_tables in write_priomap,
> >we can only allocate the net device's priomap which we change through
> >net_prio.ifpriomap.
> >
> >this patch also add a return value for update_netdev_tables &
> >extend_netdev_table, so when new_priomap is allocated failed,
> >write_priomap will stop to access the priomap,and return -ENOMEM
> >back to the userspace to tell the user what happend.
> >
> >Change From v3:
> >1. add rtnl protect when reading max_prioidx in write_priomap.
> >
> >2. only call extend_netdev_table when map->priomap_len < max_len,
> >    this will make sure array size of dev->map->priomap always
> >    bigger than any prioidx.
> >
> >3. add a function write_update_netdev_table to make codes clear.
> >
> >Change From v2:
> >1. protect extend_netdev_table by RTNL.
> >2. when extend_netdev_table failed,call dev_put to reduce device's refcount.
> >
> >Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> >Cc: Neil Horman <nhorman@tuxdriver.com>
> >Cc: Eric Dumazet <edumazet@google.com>
> >---
> >  net/core/netprio_cgroup.c |   71 ++++++++++++++++++++++++++++++++++-----------
> >  1 files changed, 54 insertions(+), 17 deletions(-)
> >
> 
> [...]
> 
> >+
> >+static int update_netdev_tables(void)
> >+{
> >+	int ret = 0;
> >  	struct net_device *dev;
> >-	u32 max_len = atomic_read(&max_prioidx) + 1;
> >+	u32 max_len;
> >  	struct netprio_map *map;
> 
> 
> need to check if net subsystem is initialized before we try
> to use it here...
> 
> 	if (some_check)     -> need to lookup what this check is
> 		return ret;
> 
> >
> >  	rtnl_lock();
> >+	max_len = atomic_read(&max_prioidx) + 1;
> >  	for_each_netdev(&init_net, dev) {
> >  		map = rtnl_dereference(dev->priomap);
> >-		if ((!map) ||
> >-		    (map->priomap_len < max_len))
> >-			extend_netdev_table(dev, max_len);
> >+		/*
> >+		 * don't allocate priomap if we didn't
> >+		 * change net_prio.ifpriomap (map == NULL),
> >+		 * this will speed up skb_update_prio.
> >+		 */
> >+		if (map && map->priomap_len < max_len) {
> >+			ret = extend_netdev_table(dev, max_len);
> >+			if (ret < 0)
> >+				break;
> >+		}
> >  	}
> >  	rtnl_unlock();
> >+	return ret;
> >  }
> >
> >  static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
> >  {
> >  	struct cgroup_netprio_state *cs;
> >-	int ret;
> >+	int ret = -EINVAL;
> >
> >  	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
> >  	if (!cs)
> >  		return ERR_PTR(-ENOMEM);
> >
> >-	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
> >-		kfree(cs);
> >-		return ERR_PTR(-EINVAL);
> >-	}
> >+	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
> >+		goto out;
> >
> >  	ret = get_prioidx(&cs->prioidx);
> >-	if (ret != 0) {
> >+	if (ret < 0) {
> >  		pr_warn("No space in priority index array\n");
> >-		kfree(cs);
> >-		return ERR_PTR(ret);
> >+		goto out;
> >+	}
> >+
> >+	ret = update_netdev_tables();
> >+	if (ret < 0) {
> >+		put_prioidx(cs->prioidx);
> >+		goto out;
> >  	}
> 
> Gao,
> 
> This introduces a null ptr dereference when netprio_cgroup is built
> into the kernel because update_netdev_tables() depends on init_net.
> However cgrp_create is being called by cgroup_init before
> do_initcalls() is called and before net_dev_init().
> 
> .John
> 
Not sure I follow here John.  Shouldn't init_net be initialized prior to any
network devices getting registered?  In other words, shouldn't for_each_netdev
just result in zero iterations through the loop?
Neil

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[John Fastabend]

On 7/18/2012 5:21 AM, Neil Horman wrote:
> On Tue, Jul 17, 2012 at 01:47:25PM -0700, John Fastabend wrote:
>> On 7/12/2012 12:50 AM, Gao feng wrote:
>>> there are some out of bound accesses in netprio cgroup.
>>>
>>> now before accessing the dev->priomap.priomap array,we only check
>>> if the dev->priomap exist.and because we don't want to see
>>> additional bound checkings in fast path, so we should make sure
>>> that dev->priomap is null or array size of dev->priomap.priomap
>>> is equal to max_prioidx + 1;
>>>
>>> so in write_priomap logic,we should call extend_netdev_table when
>>> dev->priomap is null and dev->priomap.priomap_len < max_len.
>>> and in cgrp_create->update_netdev_tables logic,we should call
>>> extend_netdev_table only when dev->priomap exist and
>>> dev->priomap.priomap_len < max_len.
>>>
>>> and it's not needed to call update_netdev_tables in write_priomap,
>>> we can only allocate the net device's priomap which we change through
>>> net_prio.ifpriomap.
>>>
>>> this patch also add a return value for update_netdev_tables &
>>> extend_netdev_table, so when new_priomap is allocated failed,
>>> write_priomap will stop to access the priomap,and return -ENOMEM
>>> back to the userspace to tell the user what happend.
>>>
>>> Change From v3:
>>> 1. add rtnl protect when reading max_prioidx in write_priomap.
>>>
>>> 2. only call extend_netdev_table when map->priomap_len < max_len,
>>>     this will make sure array size of dev->map->priomap always
>>>     bigger than any prioidx.
>>>
>>> 3. add a function write_update_netdev_table to make codes clear.
>>>
>>> Change From v2:
>>> 1. protect extend_netdev_table by RTNL.
>>> 2. when extend_netdev_table failed,call dev_put to reduce device's refcount.
>>>
>>> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
>>> Cc: Neil Horman <nhorman@tuxdriver.com>
>>> Cc: Eric Dumazet <edumazet@google.com>
>>> ---
>>>   net/core/netprio_cgroup.c |   71 ++++++++++++++++++++++++++++++++++-----------
>>>   1 files changed, 54 insertions(+), 17 deletions(-)
>>>
>>
>> [...]
>>
>>> +
>>> +static int update_netdev_tables(void)
>>> +{
>>> +	int ret = 0;
>>>   	struct net_device *dev;
>>> -	u32 max_len = atomic_read(&max_prioidx) + 1;
>>> +	u32 max_len;
>>>   	struct netprio_map *map;
>>
>>
>> need to check if net subsystem is initialized before we try
>> to use it here...
>>
>> 	if (some_check)     -> need to lookup what this check is
>> 		return ret;
>>
>>>
>>>   	rtnl_lock();
>>> +	max_len = atomic_read(&max_prioidx) + 1;
>>>   	for_each_netdev(&init_net, dev) {
>>>   		map = rtnl_dereference(dev->priomap);
>>> -		if ((!map) ||
>>> -		    (map->priomap_len < max_len))
>>> -			extend_netdev_table(dev, max_len);
>>> +		/*
>>> +		 * don't allocate priomap if we didn't
>>> +		 * change net_prio.ifpriomap (map == NULL),
>>> +		 * this will speed up skb_update_prio.
>>> +		 */
>>> +		if (map && map->priomap_len < max_len) {
>>> +			ret = extend_netdev_table(dev, max_len);
>>> +			if (ret < 0)
>>> +				break;
>>> +		}
>>>   	}
>>>   	rtnl_unlock();
>>> +	return ret;
>>>   }
>>>
>>>   static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
>>>   {
>>>   	struct cgroup_netprio_state *cs;
>>> -	int ret;
>>> +	int ret = -EINVAL;
>>>
>>>   	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
>>>   	if (!cs)
>>>   		return ERR_PTR(-ENOMEM);
>>>
>>> -	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
>>> -		kfree(cs);
>>> -		return ERR_PTR(-EINVAL);
>>> -	}
>>> +	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
>>> +		goto out;
>>>
>>>   	ret = get_prioidx(&cs->prioidx);
>>> -	if (ret != 0) {
>>> +	if (ret < 0) {
>>>   		pr_warn("No space in priority index array\n");
>>> -		kfree(cs);
>>> -		return ERR_PTR(ret);
>>> +		goto out;
>>> +	}
>>> +
>>> +	ret = update_netdev_tables();
>>> +	if (ret < 0) {
>>> +		put_prioidx(cs->prioidx);
>>> +		goto out;
>>>   	}
>>
>> Gao,
>>
>> This introduces a null ptr dereference when netprio_cgroup is built
>> into the kernel because update_netdev_tables() depends on init_net.
>> However cgrp_create is being called by cgroup_init before
>> do_initcalls() is called and before net_dev_init().
>>
>> .John
>>
> Not sure I follow here John.  Shouldn't init_net be initialized prior to any
> network devices getting registered?  In other words, shouldn't for_each_netdev
> just result in zero iterations through the loop?
> Neil
>

init_net _is_ initialized prior to any network devices getting
registered but not before cgrp_create called via cgroup_init.

#define for_each_netdev(net, d)         \
                 list_for_each_entry(d, &(net)->dev_base_head, dev_list)

but dev_base_head is zeroed at this time. In netdev_init we have,

         INIT_LIST_HEAD(&net->dev_base_head);

but we haven't got that far yet because cgroup_init is called
before do_initcalls().

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[Neil Horman]

On Wed, Jul 18, 2012 at 07:10:18AM -0700, John Fastabend wrote:
> On 7/18/2012 5:21 AM, Neil Horman wrote:
> >On Tue, Jul 17, 2012 at 01:47:25PM -0700, John Fastabend wrote:
> >>On 7/12/2012 12:50 AM, Gao feng wrote:
> >>>there are some out of bound accesses in netprio cgroup.
> >>>
> >>>now before accessing the dev->priomap.priomap array,we only check
> >>>if the dev->priomap exist.and because we don't want to see
> >>>additional bound checkings in fast path, so we should make sure
> >>>that dev->priomap is null or array size of dev->priomap.priomap
> >>>is equal to max_prioidx + 1;
> >>>
> >>>so in write_priomap logic,we should call extend_netdev_table when
> >>>dev->priomap is null and dev->priomap.priomap_len < max_len.
> >>>and in cgrp_create->update_netdev_tables logic,we should call
> >>>extend_netdev_table only when dev->priomap exist and
> >>>dev->priomap.priomap_len < max_len.
> >>>
> >>>and it's not needed to call update_netdev_tables in write_priomap,
> >>>we can only allocate the net device's priomap which we change through
> >>>net_prio.ifpriomap.
> >>>
> >>>this patch also add a return value for update_netdev_tables &
> >>>extend_netdev_table, so when new_priomap is allocated failed,
> >>>write_priomap will stop to access the priomap,and return -ENOMEM
> >>>back to the userspace to tell the user what happend.
> >>>
> >>>Change From v3:
> >>>1. add rtnl protect when reading max_prioidx in write_priomap.
> >>>
> >>>2. only call extend_netdev_table when map->priomap_len < max_len,
> >>>    this will make sure array size of dev->map->priomap always
> >>>    bigger than any prioidx.
> >>>
> >>>3. add a function write_update_netdev_table to make codes clear.
> >>>
> >>>Change From v2:
> >>>1. protect extend_netdev_table by RTNL.
> >>>2. when extend_netdev_table failed,call dev_put to reduce device's refcount.
> >>>
> >>>Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
> >>>Cc: Neil Horman <nhorman@tuxdriver.com>
> >>>Cc: Eric Dumazet <edumazet@google.com>
> >>>---
> >>>  net/core/netprio_cgroup.c |   71 ++++++++++++++++++++++++++++++++++-----------
> >>>  1 files changed, 54 insertions(+), 17 deletions(-)
> >>>
> >>
> >>[...]
> >>
> >>>+
> >>>+static int update_netdev_tables(void)
> >>>+{
> >>>+	int ret = 0;
> >>>  	struct net_device *dev;
> >>>-	u32 max_len = atomic_read(&max_prioidx) + 1;
> >>>+	u32 max_len;
> >>>  	struct netprio_map *map;
> >>
> >>
> >>need to check if net subsystem is initialized before we try
> >>to use it here...
> >>
> >>	if (some_check)     -> need to lookup what this check is
> >>		return ret;
> >>
> >>>
> >>>  	rtnl_lock();
> >>>+	max_len = atomic_read(&max_prioidx) + 1;
> >>>  	for_each_netdev(&init_net, dev) {
> >>>  		map = rtnl_dereference(dev->priomap);
> >>>-		if ((!map) ||
> >>>-		    (map->priomap_len < max_len))
> >>>-			extend_netdev_table(dev, max_len);
> >>>+		/*
> >>>+		 * don't allocate priomap if we didn't
> >>>+		 * change net_prio.ifpriomap (map == NULL),
> >>>+		 * this will speed up skb_update_prio.
> >>>+		 */
> >>>+		if (map && map->priomap_len < max_len) {
> >>>+			ret = extend_netdev_table(dev, max_len);
> >>>+			if (ret < 0)
> >>>+				break;
> >>>+		}
> >>>  	}
> >>>  	rtnl_unlock();
> >>>+	return ret;
> >>>  }
> >>>
> >>>  static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
> >>>  {
> >>>  	struct cgroup_netprio_state *cs;
> >>>-	int ret;
> >>>+	int ret = -EINVAL;
> >>>
> >>>  	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
> >>>  	if (!cs)
> >>>  		return ERR_PTR(-ENOMEM);
> >>>
> >>>-	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
> >>>-		kfree(cs);
> >>>-		return ERR_PTR(-EINVAL);
> >>>-	}
> >>>+	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
> >>>+		goto out;
> >>>
> >>>  	ret = get_prioidx(&cs->prioidx);
> >>>-	if (ret != 0) {
> >>>+	if (ret < 0) {
> >>>  		pr_warn("No space in priority index array\n");
> >>>-		kfree(cs);
> >>>-		return ERR_PTR(ret);
> >>>+		goto out;
> >>>+	}
> >>>+
> >>>+	ret = update_netdev_tables();
> >>>+	if (ret < 0) {
> >>>+		put_prioidx(cs->prioidx);
> >>>+		goto out;
> >>>  	}
> >>
> >>Gao,
> >>
> >>This introduces a null ptr dereference when netprio_cgroup is built
> >>into the kernel because update_netdev_tables() depends on init_net.
> >>However cgrp_create is being called by cgroup_init before
> >>do_initcalls() is called and before net_dev_init().
> >>
> >>.John
> >>
> >Not sure I follow here John.  Shouldn't init_net be initialized prior to any
> >network devices getting registered?  In other words, shouldn't for_each_netdev
> >just result in zero iterations through the loop?
> >Neil
> >
> 
> init_net _is_ initialized prior to any network devices getting
> registered but not before cgrp_create called via cgroup_init.
> 
> #define for_each_netdev(net, d)         \
>                 list_for_each_entry(d, &(net)->dev_base_head, dev_list)
> 
> but dev_base_head is zeroed at this time. In netdev_init we have,
> 
>         INIT_LIST_HEAD(&net->dev_base_head);
> 
> but we haven't got that far yet because cgroup_init is called
> before do_initcalls().
> 
ok, I see that, and it makes sense, but at this point I'm more concerned with
cgroups getting initalized twice.  The early_init flag is clear in the
cgroup_subsystem for netprio, so we really shouldn't be getting initalized from
cgroup_init.  We should be getting initalized from the module_init() call that
we register
Neil

> 
> 
> 
> 

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[Li Zefan]

>>>>>  static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)

>>>>>  {
>>>>>  	struct cgroup_netprio_state *cs;
>>>>> -	int ret;
>>>>> +	int ret = -EINVAL;
>>>>>
>>>>>  	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
>>>>>  	if (!cs)
>>>>>  		return ERR_PTR(-ENOMEM);
>>>>>
>>>>> -	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
>>>>> -		kfree(cs);
>>>>> -		return ERR_PTR(-EINVAL);
>>>>> -	}
>>>>> +	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
>>>>> +		goto out;
>>>>>
>>>>>  	ret = get_prioidx(&cs->prioidx);
>>>>> -	if (ret != 0) {
>>>>> +	if (ret < 0) {
>>>>>  		pr_warn("No space in priority index array\n");
>>>>> -		kfree(cs);
>>>>> -		return ERR_PTR(ret);
>>>>> +		goto out;
>>>>> +	}
>>>>> +
>>>>> +	ret = update_netdev_tables();
>>>>> +	if (ret < 0) {
>>>>> +		put_prioidx(cs->prioidx);
>>>>> +		goto out;
>>>>>  	}
>>>>
>>>> Gao,
>>>>
>>>> This introduces a null ptr dereference when netprio_cgroup is built
>>>> into the kernel because update_netdev_tables() depends on init_net.
>>>> However cgrp_create is being called by cgroup_init before
>>>> do_initcalls() is called and before net_dev_init().
>>>>
>>>> .John
>>>>
>>> Not sure I follow here John.  Shouldn't init_net be initialized prior to any
>>> network devices getting registered?  In other words, shouldn't for_each_netdev
>>> just result in zero iterations through the loop?
>>> Neil
>>>
>>
>> init_net _is_ initialized prior to any network devices getting
>> registered but not before cgrp_create called via cgroup_init.
>>
>> #define for_each_netdev(net, d)         \
>>                 list_for_each_entry(d, &(net)->dev_base_head, dev_list)
>>
>> but dev_base_head is zeroed at this time. In netdev_init we have,
>>
>>         INIT_LIST_HEAD(&net->dev_base_head);
>>
>> but we haven't got that far yet because cgroup_init is called
>> before do_initcalls().
>>
> ok, I see that, and it makes sense, but at this point I'm more concerned with
> cgroups getting initalized twice.  The early_init flag is clear in the
> cgroup_subsystem for netprio, so we really shouldn't be getting initalized from
> cgroup_init. We should be getting initalized from the module_init() call that

> we register

If the early_init flag is set, a cgroup subsys will be initialized from
cgroup_early_init(), otherwise cgroup_init().

If netprio is built as a module, the subsys will be initailized from module_init(),
otherwise cgroup_init() (in this case cgroup_load_subsys() called in module_init()
is a no-op).

So it won't get initialized twice.

Re: [PATCH v4] net: cgroup: fix access the unallocated memory in netprio cgroup

[Neil Horman]

On Thu, Jul 19, 2012 at 09:00:51AM +0800, Li Zefan wrote:
> >>>>>  static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
> 
> >>>>>  {
> >>>>>  	struct cgroup_netprio_state *cs;
> >>>>> -	int ret;
> >>>>> +	int ret = -EINVAL;
> >>>>>
> >>>>>  	cs = kzalloc(sizeof(*cs), GFP_KERNEL);
> >>>>>  	if (!cs)
> >>>>>  		return ERR_PTR(-ENOMEM);
> >>>>>
> >>>>> -	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
> >>>>> -		kfree(cs);
> >>>>> -		return ERR_PTR(-EINVAL);
> >>>>> -	}
> >>>>> +	if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
> >>>>> +		goto out;
> >>>>>
> >>>>>  	ret = get_prioidx(&cs->prioidx);
> >>>>> -	if (ret != 0) {
> >>>>> +	if (ret < 0) {
> >>>>>  		pr_warn("No space in priority index array\n");
> >>>>> -		kfree(cs);
> >>>>> -		return ERR_PTR(ret);
> >>>>> +		goto out;
> >>>>> +	}
> >>>>> +
> >>>>> +	ret = update_netdev_tables();
> >>>>> +	if (ret < 0) {
> >>>>> +		put_prioidx(cs->prioidx);
> >>>>> +		goto out;
> >>>>>  	}
> >>>>
> >>>> Gao,
> >>>>
> >>>> This introduces a null ptr dereference when netprio_cgroup is built
> >>>> into the kernel because update_netdev_tables() depends on init_net.
> >>>> However cgrp_create is being called by cgroup_init before
> >>>> do_initcalls() is called and before net_dev_init().
> >>>>
> >>>> .John
> >>>>
> >>> Not sure I follow here John.  Shouldn't init_net be initialized prior to any
> >>> network devices getting registered?  In other words, shouldn't for_each_netdev
> >>> just result in zero iterations through the loop?
> >>> Neil
> >>>
> >>
> >> init_net _is_ initialized prior to any network devices getting
> >> registered but not before cgrp_create called via cgroup_init.
> >>
> >> #define for_each_netdev(net, d)         \
> >>                 list_for_each_entry(d, &(net)->dev_base_head, dev_list)
> >>
> >> but dev_base_head is zeroed at this time. In netdev_init we have,
> >>
> >>         INIT_LIST_HEAD(&net->dev_base_head);
> >>
> >> but we haven't got that far yet because cgroup_init is called
> >> before do_initcalls().
> >>
> > ok, I see that, and it makes sense, but at this point I'm more concerned with
> > cgroups getting initalized twice.  The early_init flag is clear in the
> > cgroup_subsystem for netprio, so we really shouldn't be getting initalized from
> > cgroup_init. We should be getting initalized from the module_init() call that
> 
> > we register
> 
> If the early_init flag is set, a cgroup subsys will be initialized from
> cgroup_early_init(), otherwise cgroup_init().
> 
> If netprio is built as a module, the subsys will be initailized from module_init(),
> otherwise cgroup_init() (in this case cgroup_load_subsys() called in module_init()
> is a no-op).
> 
> So it won't get initialized twice.
> 
> 
Yeah, we already figured that out :).

Still its not a sane interface.  If you create a module_init function for a bit
of code, you expect that function to be called before the rest of your code ever
gets executed.  The way cgroup_init works, ss->cgroup_create gets called before
the module_init routine does when the module is built monolithically.  So no, no
double initalization, but definately some behavior that is going to be prone to
mistakes.
Neil