diff options
| author |   Jakub Kicinski <kuba@kernel.org> | 2021-09-30 14:49:21 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2021-09-30 14:49:21 -0700 |
| commit | dd9a887b35b01d7027f974f5e7936f1410ab51ca (patch) | |
| tree | 4a827b3e88fd896de1408c26ebebc2535b14750a /net/sched | |
| parent | Merge branch 'snmp-optimizations' (diff) | |
| parent | Merge tag 'net-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (diff) | |
| download | linux-dev-dd9a887b35b01d7027f974f5e7936f1410ab51ca.tar.xz linux-dev-dd9a887b35b01d7027f974f5e7936f1410ab51ca.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
drivers/net/phy/bcm7xxx.c
d88fd1b546ff ("net: phy: bcm7xxx: Fixed indirect MMD operations")
f68d08c437f9 ("net: phy: bcm7xxx: Add EPHY entry for 72165")
net/sched/sch_api.c
b193e15ac69d ("net: prevent user from passing illegal stab size")
69508d43334e ("net_sched: Use struct_size() and flex_array_size() helpers")
Both cases trivial - adjacent code additions.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/cls_flower.c | 6 | ||||
| -rw-r--r-- | net/sched/sch_api.c | 6 |
2 files changed, 12 insertions, 0 deletions
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index 23b21253b3c3..eb6345a027e1 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -2188,18 +2188,24 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg, arg->count = arg->skip; + rcu_read_lock(); idr_for_each_entry_continue_ul(&head->handle_idr, f, tmp, id) { /* don't return filters that are being deleted */ if (!refcount_inc_not_zero(&f->refcnt)) continue; + rcu_read_unlock(); + if (arg->fn(tp, f, arg) < 0) { __fl_put(f); arg->stop = 1; + rcu_read_lock(); break; } __fl_put(f); arg->count++; + rcu_read_lock(); } + rcu_read_unlock(); arg->cookie = id; } diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index e1a40d3b1ed0..91820f67275c 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -514,6 +514,12 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt, return stab; } + if (s->size_log > STAB_SIZE_LOG_MAX || + s->cell_log > STAB_SIZE_LOG_MAX) { + NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table"); + return ERR_PTR(-EINVAL); + } + stab = kmalloc(struct_size(stab, data, tsize), GFP_KERNEL); if (!stab) return ERR_PTR(-ENOMEM); |