TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/net/sched
History
Vlad Buslov d9976d29c2 net: sched: fix police ext initialization 
commit 396d7f23adf9e8c436dd81a69488b5b6a865acf8 upstream.

When police action is created by cls API tcf_exts_validate() first
conditional that calls tcf_action_init_1() directly, the action idr is not
updated according to latest changes in action API that require caller to
commit newly created action to idr with tcf_idr_insert_many(). This results
such action not being accessible through act API and causes crash reported
by syzbot:

==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
BUG: KASAN: null-ptr-deref in __tcf_idr_release net/sched/act_api.c:178 [inline]
BUG: KASAN: null-ptr-deref in tcf_idrinfo_destroy+0x129/0x1d0 net/sched/act_api.c:598
Read of size 4 at addr 0000000000000010 by task kworker/u4:5/204

CPU: 0 PID: 204 Comm: kworker/u4:5 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 __kasan_report mm/kasan/report.c:400 [inline]
 kasan_report.cold+0x5f/0xd5 mm/kasan/report.c:413
 check_memory_region_inline mm/kasan/generic.c:179 [inline]
 check_memory_region+0x13d/0x180 mm/kasan/generic.c:185
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 __tcf_idr_release net/sched/act_api.c:178 [inline]
 tcf_idrinfo_destroy+0x129/0x1d0 net/sched/act_api.c:598
 tc_action_net_exit include/net/act_api.h:151 [inline]
 police_exit_net+0x168/0x360 net/sched/act_police.c:390
 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:190
 cleanup_net+0x4ea/0xb10 net/core/net_namespace.c:604
 process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 204 Comm: kworker/u4:5 Tainted: G    B             5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 panic+0x306/0x73d kernel/panic.c:231
 end_report+0x58/0x5e mm/kasan/report.c:100
 __kasan_report mm/kasan/report.c:403 [inline]
 kasan_report.cold+0x67/0xd5 mm/kasan/report.c:413
 check_memory_region_inline mm/kasan/generic.c:179 [inline]
 check_memory_region+0x13d/0x180 mm/kasan/generic.c:185
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
 __tcf_idr_release net/sched/act_api.c:178 [inline]
 tcf_idrinfo_destroy+0x129/0x1d0 net/sched/act_api.c:598
 tc_action_net_exit include/net/act_api.h:151 [inline]
 police_exit_net+0x168/0x360 net/sched/act_police.c:390
 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:190
 cleanup_net+0x4ea/0xb10 net/core/net_namespace.c:604
 process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Kernel Offset: disabled

Fix the issue by calling tcf_idr_insert_many() after successful action
initialization.

Fixes: 0fedc63fadf0 ("net_sched: commit action insertions together")
Reported-by: syzbot+151e3e714d34ae4ce7e8@syzkaller.appspotmail.com
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-04-12 12:52:42 +08:00
..
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
act_api.c net: sched: fix police ext initialization 2021-04-12 12:52:42 +08:00
act_bpf.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_connmark.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_csum.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_ct.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_ctinfo.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_gact.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_ife.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_ipt.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_meta_mark.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
act_meta_skbprio.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
act_meta_skbtcindex.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
act_mirred.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_mpls.c net/sched: act_mpls: ensure LSE is pullable before reading it 2021-03-16 16:41:57 +08:00
act_nat.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_pedit.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_police.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_sample.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_simple.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_skbedit.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_skbmod.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
act_tunnel_key.c net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels 2021-03-16 16:38:17 +08:00
act_vlan.c net_sched: defer tcf_idr_insert() in tcf_action_init_1() 2021-03-16 16:38:07 +08:00
cls_api.c net: sched: fix police ext initialization 2021-04-12 12:52:42 +08:00
cls_basic.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_bpf.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_cgroup.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_flow.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
cls_flower.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
cls_fw.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_matchall.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_route.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_rsvp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_rsvp.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_rsvp6.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cls_tcindex.c net_sched: avoid shift-out-of-bounds in tcindex_set_parms() 2021-04-12 12:51:39 +08:00
cls_u32.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
em_canid.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
em_cmp.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
em_ipset.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
em_ipt.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
em_meta.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
em_nbyte.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
em_text.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
em_u32.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ematch.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_api.c net_sched: reject silly cell_log in qdisc_get_rtab() 2021-04-12 12:51:40 +08:00
sch_atm.c net_sched: fix a memory leak in atm_tc_init() 2021-03-16 16:31:44 +08:00
sch_blackhole.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_cake.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
sch_cbq.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_cbs.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_choke.c net: sched: prevent invalid Scell_log shift count 2021-04-12 12:51:09 +08:00
sch_codel.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_drr.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_dsmark.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00
sch_etf.c sched: etf: do not assume all sockets are full blown 2021-03-16 16:26:52 +08:00
sch_fifo.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_fq.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_fq_codel.c fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks 2021-03-16 16:27:33 +08:00
sch_generic.c net: sch_generic: fix the missing new qdisc assignment bug 2021-03-16 16:41:00 +08:00
sch_gred.c net: sched: prevent invalid Scell_log shift count 2021-04-12 12:51:09 +08:00
sch_hfsc.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_hhf.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_htb.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_ingress.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_mq.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_mqprio.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_multiq.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_netem.c netem: fix zero division in tabledist 2021-03-16 16:39:31 +08:00
sch_pie.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_plug.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_prio.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_qfq.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_red.c net: sched: prevent invalid Scell_log shift count 2021-04-12 12:51:09 +08:00
sch_sfb.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_sfq.c net: sched: prevent invalid Scell_log shift count 2021-04-12 12:51:09 +08:00
sch_skbprio.c net_sched: sch_skbprio: add message validation to skbprio_change() 2021-03-16 16:27:34 +08:00
sch_taprio.c net/sched: sch_taprio: ensure to reset/destroy all child qdiscs 2021-04-12 12:51:10 +08:00
sch_tbf.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sch_teql.c sched: consistently handle layer3 header accesses in the presence of VLANs 2021-03-16 16:31:44 +08:00