Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-13 15:41:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

net: ppp: Don't call bpf_prog_create() in ppp_lock

Browse Source 
In ppp_ioctl(), bpf_prog_create() is called inside ppp_lock, which
eventually calls vmalloc() and hits BUG_ON() in vmalloc.c.  This patch
works around the problem by moving the allocation outside the lock.

The bug was revealed by the recent change in net/core/filter.c, as it
allocates via vmalloc() instead of kmalloc() now.

Reported-and-tested-by: Stefan Seyfried <stefan.seyfried@googlemail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Takashi Iwai 2014-11-10 11:50:21 +01:00 committed by David S. Miller
parent f4a1edd561
commit 5748eb8f8e
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
drivers/net/ppp/ppp_generic.c
View File

@ -755,23 +755,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
err = get_filter(argp, &code);
if (err >= 0) {
struct bpf_prog *pass_filter = NULL;
struct sock_fprog_kern fprog = {
.len = err,
.filter = code,
};
ppp_lock(ppp);
if (ppp->pass_filter) {
bpf_prog_destroy(ppp->pass_filter);
ppp->pass_filter = NULL;
err = 0;
if (fprog.filter)
err = bpf_prog_create(&pass_filter, &fprog);
if (!err) {
ppp_lock(ppp);
if (ppp->pass_filter)
bpf_prog_destroy(ppp->pass_filter);
ppp->pass_filter = pass_filter;
ppp_unlock(ppp);
}
if (fprog.filter != NULL)
err = bpf_prog_create(&ppp->pass_filter,
&fprog);
else
err = 0;
kfree(code);
ppp_unlock(ppp);
}
break;
}
@ -781,23 +781,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
err = get_filter(argp, &code);
if (err >= 0) {
struct bpf_prog *active_filter = NULL;
struct sock_fprog_kern fprog = {
.len = err,
.filter = code,
};
ppp_lock(ppp);
if (ppp->active_filter) {
bpf_prog_destroy(ppp->active_filter);
ppp->active_filter = NULL;
err = 0;
if (fprog.filter)
err = bpf_prog_create(&active_filter, &fprog);
if (!err) {
ppp_lock(ppp);
if (ppp->active_filter)
bpf_prog_destroy(ppp->active_filter);
ppp->active_filter = active_filter;
ppp_unlock(ppp);
}
if (fprog.filter != NULL)
err = bpf_prog_create(&ppp->active_filter,
&fprog);
else
err = 0;
kfree(code);
ppp_unlock(ppp);
}
break;
}