[Devel] [PATCH vz10 15/24] ve/hooks: fix off-by-one in chain bounds check

[Pavel Tikhomirov]

Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

On 7/6/26 12:59, Konstantin Khorenko wrote:
> ve_hooks[] has VE_MAX_CHAINS elements, so valid indices are
> 0..VE_MAX_CHAINS-1. The guard in ve_hook_register() used
> "chain > VE_MAX_CHAINS", which lets chain == VE_MAX_CHAINS through
> and then indexes one element past the end of the array, corrupting
> whatever lies behind it via list_add_tail().
> 
> Today the only chain value passed by in-tree callers is VE_SS_CHAIN
> (0), so the bug is dormant. But the whole point of this BUG_ON is to
> catch a caller passing VE_MAX_CHAINS by mistake (e.g. after the enum
> grows), and in its current form it silently allows exactly that
> out-of-bounds write instead of tripping. Use ">=" so the check
> rejects the first invalid index.
> 
> Fixes: 3203339c2209 ("ve: Add ve cgroup and ve_hook subsys")
> Feature: ve: ve generic structures
> https://virtuozzo.atlassian.net/browse/VSTOR-137234
> Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
> ---
>  kernel/ve/hooks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/ve/hooks.c b/kernel/ve/hooks.c
> index df9317430114..273961069a23 100644
> --- a/kernel/ve/hooks.c
> +++ b/kernel/ve/hooks.c
> @@ -20,7 +20,7 @@ void ve_hook_register(int chain, struct ve_hook *vh)
>  	struct list_head *lh;
>  	struct ve_hook *tmp;
>  
> -	BUG_ON(chain > VE_MAX_CHAINS);
> +	BUG_ON(chain >= VE_MAX_CHAINS);
>  
>  	down_write(&ve_hook_sem);
>  	list_for_each(lh, &ve_hooks[chain]) {

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.