From: Jiri Pirko <jiri@resnulli.us>
To: Davide Caratti <dcaratti@redhat.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Roman Mashak <mrv@mojatatu.com>,
Manish Kurup <kurup.manish@gmail.com>,
netdev@vger.kernel.org
Subject: Re: [PATCH net 5/5] net/sched: fix NULL dereference on the error path of tcf_skbmod_init()
Date: Fri, 16 Mar 2018 09:27:22 +0100 [thread overview]
Message-ID: <20180316082722.GM2130@nanopsycho> (raw)
In-Reply-To: <19f092b6f400a8bcc135bb45dc0dd4f4b60add7b.1521154629.git.dcaratti@redhat.com>
Fri, Mar 16, 2018 at 12:00:57AM CET, dcaratti@redhat.com wrote:
>when the following command
>
> # tc action replace action skbmod swap mac index 100
>
>is run for the first time, and tcf_skbmod_init() fails to allocate struct
>tcf_skbmod_params, tcf_skbmod_cleanup() calls kfree_rcu(NULL), thus
>causing the following error:
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
> IP: __call_rcu+0x23/0x2b0
> PGD 8000000034057067 P4D 8000000034057067 PUD 74937067 PMD 0
> Oops: 0002 [#1] SMP PTI
> Modules linked in: act_skbmod(E) psample ip6table_filter ip6_tables iptable_filter binfmt_misc ext4 snd_hda_codec_generic snd_hda_intel snd_hda_codec crct10dif_pclmul mbcache jbd2 crc32_pclmul snd_hda_core ghash_clmulni_intel snd_hwdep pcbc snd_seq snd_seq_device snd_pcm aesni_intel snd_timer crypto_simd glue_helper snd cryptd virtio_balloon joydev soundcore pcspkr i2c_piix4 nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c ata_generic pata_acpi qxl drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm virtio_console virtio_net virtio_blk ata_piix libata crc32c_intel virtio_pci serio_raw virtio_ring virtio i2c_core floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: act_skbmod]
> CPU: 3 PID: 3144 Comm: tc Tainted: G E 4.16.0-rc4.act_vlan.orig+ #403
> Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> RIP: 0010:__call_rcu+0x23/0x2b0
> RSP: 0018:ffffbd2e403e7798 EFLAGS: 00010246
> RAX: ffffffffc0872080 RBX: ffff981d34bff780 RCX: 00000000ffffffff
> RDX: ffffffff922a5f00 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000021f
> R10: 000000003d003000 R11: 0000000000aaaaaa R12: 0000000000000000
> R13: ffffffff922a5f00 R14: 0000000000000001 R15: ffff981d3b698c2c
> FS: 00007f3678292740(0000) GS:ffff981d3fd80000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000008 CR3: 000000007c57a006 CR4: 00000000001606e0
> Call Trace:
> __tcf_idr_release+0x79/0xf0
> tcf_skbmod_init+0x1d1/0x210 [act_skbmod]
> tcf_action_init_1+0x2cc/0x430
> tcf_action_init+0xd3/0x1b0
> tc_ctl_action+0x18b/0x240
> rtnetlink_rcv_msg+0x29c/0x310
> ? _cond_resched+0x15/0x30
> ? __kmalloc_node_track_caller+0x1b9/0x270
> ? rtnl_calcit.isra.28+0x100/0x100
> netlink_rcv_skb+0xd2/0x110
> netlink_unicast+0x17c/0x230
> netlink_sendmsg+0x2cd/0x3c0
> sock_sendmsg+0x30/0x40
> ___sys_sendmsg+0x27a/0x290
> ? filemap_map_pages+0x34a/0x3a0
> ? __handle_mm_fault+0xbfd/0xe20
> __sys_sendmsg+0x51/0x90
> do_syscall_64+0x6e/0x1a0
> entry_SYSCALL_64_after_hwframe+0x3d/0xa2
> RIP: 0033:0x7f36776a3ba0
> RSP: 002b:00007fff4703b618 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007fff4703b740 RCX: 00007f36776a3ba0
> RDX: 0000000000000000 RSI: 00007fff4703b690 RDI: 0000000000000003
> RBP: 000000005aaaba36 R08: 0000000000000002 R09: 0000000000000000
> R10: 00007fff4703b0a0 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fff4703b754 R14: 0000000000000001 R15: 0000000000669f60
> Code: 5d e9 42 da ff ff 66 90 0f 1f 44 00 00 41 57 41 56 41 55 49 89 d5 41 54 55 48 89 fd 53 48 83 ec 08 40 f6 c7 07 0f 85 19 02 00 00 <48> 89 75 08 48 c7 45 00 00 00 00 00 9c 58 0f 1f 44 00 00 49 89
> RIP: __call_rcu+0x23/0x2b0 RSP: ffffbd2e403e7798
> CR2: 0000000000000008
>
>Fix it in tcf_skbmod_cleanup(), ensuring that kfree_rcu(p, ...) is called
>only when p is not NULL.
>
>Fixes: 86da71b57383 ("net_sched: Introduce skbmod action")
>Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
next prev parent reply other threads:[~2018-03-16 8:27 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-15 23:00 [PATCH net 0/5] net/sched: fix NULL dereference in the error path of .init() Davide Caratti
2018-03-15 23:00 ` [PATCH net 1/5] net/sched: fix NULL dereference in the error path of tcf_vlan_init() Davide Caratti
2018-03-15 23:00 ` [PATCH net 2/5] net/sched: fix NULL dereference in the error path of tcf_csum_init() Davide Caratti
2018-03-16 8:26 ` Jiri Pirko
2018-03-15 23:00 ` [PATCH net 3/5] net/sched: fix NULL dereference in the error path of tunnel_key_init() Davide Caratti
2018-03-16 8:26 ` Jiri Pirko
2018-03-15 23:00 ` [PATCH net 4/5] net/sched: fix NULL dereference in the error path of tcf_sample_init() Davide Caratti
2018-03-16 8:27 ` Jiri Pirko
2018-03-15 23:00 ` [PATCH net 5/5] net/sched: fix NULL dereference on the error path of tcf_skbmod_init() Davide Caratti
2018-03-16 8:27 ` Jiri Pirko [this message]
2018-03-17 23:53 ` [PATCH net 0/5] net/sched: fix NULL dereference in the error path of .init() David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180316082722.GM2130@nanopsycho \
--to=jiri@resnulli.us \
--cc=davem@davemloft.net \
--cc=dcaratti@redhat.com \
--cc=kurup.manish@gmail.com \
--cc=mrv@mojatatu.com \
--cc=netdev@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.