Unverified Commit f5fda1e9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8895 net: fix out-of-bounds access in ops_init 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LDSOHIBKVQHPB4BRP75XBDQHU2MEBTO3/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9TMCC 
 
Link:https://gitee.com/openeuler/kernel/pulls/8895

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents e9479480 c73bf4eb

net/core/net_namespace.c

+10 −3
Original line number Diff line number Diff line
@@ -63,12 +63,15 @@ static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; 


static struct net_generic *net_alloc_generic(void)

{

	unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs);

	unsigned int generic_size;

	struct net_generic *ng;

	unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);



	generic_size = offsetof(struct net_generic, ptr[gen_ptrs]);



	ng = kzalloc(generic_size, GFP_KERNEL);

	if (ng)

		ng->s.len = max_gen_ptrs;

		ng->s.len = gen_ptrs;



	return ng;

}
@@ -1018,7 +1021,11 @@ static int register_pernet_operations(struct list_head *list, 
		if (error < 0)

			return error;

		*ops->id = error;

		max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);

		/* This does not require READ_ONCE as writers already hold

		 * pernet_ops_rwsem. But WRITE_ONCE is needed to protect

		 * net_alloc_generic.

		 */

		WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1));

	}

	error = __register_pernet_operations(list, ops);

	if (error) {