leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6caabe7f19
linux/net/sched
History
Vlad Buslov ecb3dea400 net: sched: flower: insert new filter to idr after setting its mask 
When adding new filter to flower classifier, fl_change() inserts it to
handle_idr before initializing filter extensions and assigning it a mask.
Normally this ordering doesn't matter because all flower classifier ops
callbacks assume rtnl lock protection. However, when filter has an action
that doesn't have its kernel module loaded, rtnl lock is released before
call to request_module(). During this time the filter can be accessed bu
concurrent task before its initialization is completed, which can lead to a
crash.

Example case of NULL pointer dereference in concurrent dump:

Task 1                           Task 2

tc_new_tfilter()
 fl_change()
  idr_alloc_u32(fnew)
  fl_set_parms()
   tcf_exts_validate()
    tcf_action_init()
     tcf_action_init_1()
      rtnl_unlock()
      request_module()
      ...                        rtnl_lock()
      				 tc_dump_tfilter()
      				  tcf_chain_dump()
				   fl_walk()
				    idr_get_next_ul()
				    tcf_node_dump()
				     tcf_fill_node()
				      fl_dump()
				       mask = &f->mask->key; <- NULL ptr
      rtnl_lock()

Extension initialization and mask assignment don't depend on fnew->handle
that is allocated by idr_alloc_u32(). Move idr allocation code after action
creation and mask assignment in fl_change() to prevent concurrent access
to not fully initialized filter when rtnl lock is released to load action
module.

Fixes: 01683a1469 ("net: sched: refactor flower walk to iterate over idr")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-06 10:52:16 -08:00
..
act_api.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_bpf.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_connmark.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_csum.c net: sched: act_csum: Fix csum calc for tagged packets 2019-02-27 21:49:46 -08:00
act_gact.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_ife.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_ipt.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-02 12:54:35 -08:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_nat.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_pedit.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_police.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_sample.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_simple.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_skbedit.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-02 12:54:35 -08:00
act_skbmod.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_tunnel_key.c net/sched: act_tunnel_key: Fix double free dst_cache 2019-03-05 12:57:28 -08:00
act_vlan.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
cls_api.c net: sched: fix typo in walker_check_empty() 2019-02-26 09:17:49 -08:00
cls_basic.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_bpf.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_cgroup.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_flow.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_flower.c net: sched: flower: insert new filter to idr after setting its mask 2019-03-06 10:52:16 -08:00
cls_fw.c Revert "net: sched: fw: don't set arg->stop in fw_walk() when empty" 2019-02-27 10:12:19 -08:00
cls_matchall.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_route.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_rsvp6.c
cls_rsvp.c
cls_rsvp.h net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_tcindex.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_u32.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c net: sched: add em_ipt ematch for calling xtables matches 2018-02-21 13:15:33 -05:00
em_meta.c
em_nbyte.c net: sched: em_nbyte: don't add the data offset twice 2018-01-24 14:52:40 -05:00
em_text.c
em_u32.c
ematch.c
Kconfig tc: Add support for configuring the taprio scheduler 2018-10-04 13:52:23 -07:00
Makefile tc: Add support for configuring the taprio scheduler 2018-10-04 13:52:23 -07:00
sch_api.c net: sched: using kfree_rcu() to simplify the code 2019-02-18 16:34:51 -08:00
sch_atm.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_blackhole.c net_sched: blackhole: tell upper qdisc about dropped packets 2018-06-17 08:42:33 +09:00
sch_cake.c sch_cake: Simplify logic in cake_select_tin() 2019-03-03 20:14:28 -08:00
sch_cbq.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_cbs.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_choke.c
sch_codel.c
sch_drr.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_dsmark.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_etf.c etf: Drop all expired packets 2018-11-16 20:39:34 -08:00
sch_fifo.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_fq_codel.c net: Add and use skb_mark_not_on_list(). 2018-09-10 10:06:54 -07:00
sch_fq.c net_sched: sch_fq: avoid calling ktime_get_ns() if not needed 2018-11-20 09:51:32 -08:00
sch_generic.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-04 13:26:15 -08:00
sch_gred.c net: sched: gred: support reporting stats from offloads 2018-11-19 18:53:46 -08:00
sch_hfsc.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_hhf.c net: Add and use skb_mark_not_on_list(). 2018-09-10 10:06:54 -07:00
sch_htb.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_ingress.c net: sched: allow ingress and clsact qdiscs to share filter blocks 2018-01-17 14:53:57 -05:00
sch_mq.c net: sched: mq: offload a graft notification 2018-11-14 08:51:28 -08:00
sch_mqprio.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_multiq.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_netem.c net: netem: fix skb length BUG_ON in __skb_to_sgvec 2019-02-28 10:31:31 -08:00
sch_pie.c net: sched: pie: avoid slow division in drop probability decay 2019-02-28 10:35:41 -08:00
sch_plug.c
sch_prio.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_qfq.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_red.c net: sched: red: notify drivers about RED's limit parameter 2018-11-14 08:51:28 -08:00
sch_sfb.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_sfq.c
sch_skbprio.c net/sched: add skbprio scheduler 2018-07-24 14:44:00 -07:00
sch_taprio.c tc: Add support for configuring the taprio scheduler 2018-10-04 13:52:23 -07:00
sch_tbf.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_teql.c