diff options
| author | Neil Horman <nhorman@tuxdriver.com> | 2012-02-10 05:43:36 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-02-10 15:08:56 -0500 |
| commit | a87dfe14a78501c931a4d5481efff6a809aa907d (patch) | |
| tree | cecc481e2daed8dcd4fafabab04f51796dcbf945 /net/core/netprio_cgroup.c | |
| parent | 027a3b617c5490b5287d98921675abcbebeb32df (diff) | |
| download | op-kernel-dev-a87dfe14a78501c931a4d5481efff6a809aa907d.zip op-kernel-dev-a87dfe14a78501c931a4d5481efff6a809aa907d.tar.gz | |
netprio_cgroup: fix an off-by-one bug
# mount -t cgroup xxx /mnt
# mkdir /mnt/tmp
# cat /mnt/tmp/net_prio.ifpriomap
lo 0
eth0 0
virbr0 0
# echo 'lo 999' > /mnt/tmp/net_prio.ifpriomap
# cat /mnt/tmp/net_prio.ifpriomap
lo 999
eth0 0
virbr0 4101267344
We got weired output, because we exceeded the boundary of the array.
We may even crash the kernel..
Origionally-authored-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: "David S. Miller" <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/netprio_cgroup.c')
| -rw-r--r-- | net/core/netprio_cgroup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c index 9ae183a..72c6387 100644 --- a/net/core/netprio_cgroup.c +++ b/net/core/netprio_cgroup.c @@ -108,7 +108,7 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len) static void update_netdev_tables(void) { struct net_device *dev; - u32 max_len = atomic_read(&max_prioidx); + u32 max_len = atomic_read(&max_prioidx) + 1; struct netprio_map *map; rtnl_lock(); |
