[PATCH net-next] openvswitch: Initialize unmasked key and uid len

[PATCH net-next] openvswitch: Initialize unmasked key and uid len

[Pravin B Shelar]

Flow alloc needs to initialize unmasked key pointer. Otherwise
it can crash kernel trying to free random unmasked-key pointer.

general protection fault: 0000 [#1] SMP
3.19.0-rc6-net-next+ #457
Hardware name: Supermicro X7DWU/X7DWU, BIOS  1.1 04/30/2008
RIP: 0010:[<ffffffff8111df0e>] [<ffffffff8111df0e>] kfree+0xac/0x196
Call Trace:
 [<ffffffffa060bd87>] flow_free+0x21/0x59 [openvswitch]
 [<ffffffffa060bde0>] ovs_flow_free+0x21/0x23 [openvswitch]
 [<ffffffffa0605b4a>] ovs_packet_cmd_execute+0x2f3/0x35f [openvswitch]
 [<ffffffffa0605995>] ? ovs_packet_cmd_execute+0x13e/0x35f [openvswitch]
 [<ffffffff811fe6fb>] ? nla_parse+0x4f/0xec
 [<ffffffff8139a2fc>] genl_family_rcv_msg+0x26d/0x2c9
 [<ffffffff8107620f>] ? __lock_acquire+0x90e/0x9aa
 [<ffffffff8139a3be>] genl_rcv_msg+0x66/0x89
 [<ffffffff8139a358>] ? genl_family_rcv_msg+0x2c9/0x2c9
 [<ffffffff81399591>] netlink_rcv_skb+0x3e/0x95
 [<ffffffff81399898>] ? genl_rcv+0x18/0x37
 [<ffffffff813998a7>] genl_rcv+0x27/0x37
 [<ffffffff81399033>] netlink_unicast+0x103/0x191
 [<ffffffff81399382>] netlink_sendmsg+0x2c1/0x310
 [<ffffffff811007ad>] ? might_fault+0x50/0xa0
 [<ffffffff8135c773>] do_sock_sendmsg+0x5f/0x7a
 [<ffffffff8135c799>] sock_sendmsg+0xb/0xd
 [<ffffffff8135cacf>] ___sys_sendmsg+0x1a3/0x218
 [<ffffffff8113e54b>] ? get_close_on_exec+0x86/0x86
 [<ffffffff8115a9d0>] ? fsnotify+0x32c/0x348
 [<ffffffff8115a720>] ? fsnotify+0x7c/0x348
 [<ffffffff8113e5f5>] ? __fget+0xaa/0xbf
 [<ffffffff8113e54b>] ? get_close_on_exec+0x86/0x86
 [<ffffffff8135cccd>] __sys_sendmsg+0x3d/0x5e
 [<ffffffff8135cd02>] SyS_sendmsg+0x14/0x16
 [<ffffffff81411852>] system_call_fastpath+0x12/0x17

CC: Joe Stringer <joestringer@nicira.com>
Reported-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
---
 net/openvswitch/flow_table.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index 5e57628..d58447d 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -85,6 +85,8 @@ struct sw_flow *ovs_flow_alloc(void)
 
 	flow->sf_acts = NULL;
 	flow->mask = NULL;
+	flow->id.unmasked_key = NULL;
+	flow->id.ufid_len = 0;
 	flow->stats_last_writer = NUMA_NO_NODE;
 
 	/* Initialize the default stat node. */
-- 
1.7.1

Re: [PATCH net-next] openvswitch: Initialize unmasked key and uid len

[Eric Dumazet]

On Thu, 2015-02-05 at 09:56 -0800, Pravin B Shelar wrote:
> Flow alloc needs to initialize unmasked key pointer. Otherwise
> it can crash kernel trying to free random unmasked-key pointer.

> CC: Joe Stringer <joestringer@nicira.com>
> Reported-by: Or Gerlitz <ogerlitz@mellanox.com>
> Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
> ---
>  net/openvswitch/flow_table.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
> index 5e57628..d58447d 100644
> --- a/net/openvswitch/flow_table.c
> +++ b/net/openvswitch/flow_table.c
> @@ -85,6 +85,8 @@ struct sw_flow *ovs_flow_alloc(void)
>  
>  	flow->sf_acts = NULL;
>  	flow->mask = NULL;
> +	flow->id.unmasked_key = NULL;
> +	flow->id.ufid_len = 0;
>  	flow->stats_last_writer = NUMA_NO_NODE;

At this stage, one has to wonder why not using kmem_cache_zalloc()
and reduce icache pressure right ?

And please please add :

Fixes: e64457191a259 ("openvswitch: Restructure datapath.c and flow.c")

or whatever commit was the bug origin.

Thanks

Re: [PATCH net-next] openvswitch: Initialize unmasked key and uid len

[Pravin Shelar]

On Thu, Feb 5, 2015 at 10:37 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Thu, 2015-02-05 at 09:56 -0800, Pravin B Shelar wrote:
>> Flow alloc needs to initialize unmasked key pointer. Otherwise
>> it can crash kernel trying to free random unmasked-key pointer.
>
>> CC: Joe Stringer <joestringer@nicira.com>
>> Reported-by: Or Gerlitz <ogerlitz@mellanox.com>
>> Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
>> ---
>>  net/openvswitch/flow_table.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
>> index 5e57628..d58447d 100644
>> --- a/net/openvswitch/flow_table.c
>> +++ b/net/openvswitch/flow_table.c
>> @@ -85,6 +85,8 @@ struct sw_flow *ovs_flow_alloc(void)
>>
>>       flow->sf_acts = NULL;
>>       flow->mask = NULL;
>> +     flow->id.unmasked_key = NULL;
>> +     flow->id.ufid_len = 0;
>>       flow->stats_last_writer = NUMA_NO_NODE;
>
> At this stage, one has to wonder why not using kmem_cache_zalloc()
> and reduce icache pressure right ?
>
struct flow is still big struct, about 536 bytes. Most of the struct
is still not cleared. I do not want to clear it then initialize it
again. This helps in OVS flow setup performance.

> And please please add :
>
> Fixes: e64457191a259 ("openvswitch: Restructure datapath.c and flow.c")
>
> or whatever commit was the bug origin.
>
ok, I will send updated patch.

> Thanks
>
>