summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorWANG Cong <xiyou.wangcong@gmail.com>2016-11-03 09:42:36 -0700
committerDavid S. Miller <davem@davemloft.net>2016-11-03 16:55:58 -0400
commit243d52126184b072a18fe2130ce0008f8aa3a340 (patch)
treed8437d736ef3723ae9fd58aaf67d7324b2433286 /kernel
parent00ffc1ba02d876478c125e4305f9a02d40c6d284 (diff)
downloadlinux-stable-243d52126184b072a18fe2130ce0008f8aa3a340.tar.gz
linux-stable-243d52126184b072a18fe2130ce0008f8aa3a340.tar.bz2
linux-stable-243d52126184b072a18fe2130ce0008f8aa3a340.zip
taskstats: fix the length of cgroupstats_cmd_get_policy
cgroupstats_cmd_get_policy is [CGROUPSTATS_CMD_ATTR_MAX+1], taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1], but their family.maxattr is TASKSTATS_CMD_ATTR_MAX. CGROUPSTATS_CMD_ATTR_MAX is less than TASKSTATS_CMD_ATTR_MAX, so we could end up accessing out-of-bound. Change cgroupstats_cmd_get_policy to TASKSTATS_CMD_ATTR_MAX+1, this is safe because the rest are initialized to 0's. Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/taskstats.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index b3f05ee20d18..cbb387a265db 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -54,7 +54,11 @@ static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1
[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING },
[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },};
-static const struct nla_policy cgroupstats_cmd_get_policy[CGROUPSTATS_CMD_ATTR_MAX+1] = {
+/*
+ * We have to use TASKSTATS_CMD_ATTR_MAX here, it is the maxattr in the family.
+ * Make sure they are always aligned.
+ */
+static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = {
[CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 },
};