ve_hooks[] has VE_MAX_CHAINS elements, so valid indices are
0..VE_MAX_CHAINS-1. The guard in ve_hook_register() used
"chain > VE_MAX_CHAINS", which lets chain == VE_MAX_CHAINS through
and then indexes one element past the end of the array, corrupting
whatever lies behind it via list_add_tail().
Today the only chain value passed by in-tree callers is VE_SS_CHAIN
(0), so the bug is dormant. But the whole point of this BUG_ON is to
catch a caller passing VE_MAX_CHAINS by mistake (e.g. after the enum
grows), and in its current form it silently allows exactly that
out-of-bounds write instead of tripping. Use ">=" so the check
rejects the first invalid index.
Fixes: 3203339c2209 ("ve: Add ve cgroup and ve_hook subsys")
Feature: ve: ve generic structures
https://virtuozzo.atlassian.net/browse/VSTOR-137234
Signed-off-by: Konstantin Khorenko <[email protected]>
---
kernel/ve/hooks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/ve/hooks.c b/kernel/ve/hooks.c
index df9317430114..273961069a23 100644
--- a/kernel/ve/hooks.c
+++ b/kernel/ve/hooks.c
@@ -20,7 +20,7 @@ void ve_hook_register(int chain, struct ve_hook *vh)
struct list_head *lh;
struct ve_hook *tmp;
- BUG_ON(chain > VE_MAX_CHAINS);
+ BUG_ON(chain >= VE_MAX_CHAINS);
down_write(&ve_hook_sem);
list_for_each(lh, &ve_hooks[chain]) {
--
2.47.1
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
