Commit e9f60ba0 authored by Xiu Jianfeng's avatar Xiu Jianfeng Committed by Chen Ridong
Browse files

cgroup: Fix potential overflow issue when checking max_depth 

stable inclusion
from stable-v5.10.229
commit ffbb1f15bae7619be8939566f447de1e0b021c38
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBF69F

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ffbb1f15bae7619be8939566f447de1e0b021c38



--------------------------------

[ Upstream commit 3cc4e13bb1617f6a13e5e6882465984148743cf4 ]

cgroup.max.depth is the maximum allowed descent depth below the current
cgroup. If the actual descent depth is equal or larger, an attempt to
create a new child cgroup will fail. However due to the cgroup->max_depth
is of int type and having the default value INT_MAX, the condition
'level > cgroup->max_depth' will never be satisfied, and it will cause
an overflow of the level after it reaches to INT_MAX.

Fix it by starting the level from 0 and using '>=' instead.

It's worth mentioning that this issue is unlikely to occur in reality,
as it's impossible to have a depth of INT_MAX hierarchy, but should be
be avoided logically.

Fixes: 1a926e0b ("cgroup: implement hierarchy limits")
Signed-off-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Reviewed-by: default avatarMichal Koutný <mkoutny@suse.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
parent 0912fd81

kernel/cgroup/cgroup.c

+2 −2
Original line number Diff line number Diff line
@@ -5623,7 +5623,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) 
{

	struct cgroup *cgroup;

	int ret = false;

	int level = 1;

	int level = 0;



	lockdep_assert_held(&cgroup_mutex);
@@ -5631,7 +5631,7 @@ static bool cgroup_check_hierarchy_limits(struct cgroup *parent) 
		if (cgroup->nr_descendants >= cgroup->max_descendants)

			goto fail;



		if (level > cgroup->max_depth)

		if (level >= cgroup->max_depth)

			goto fail;



		level++;