From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Subject: Re: size overflow in function qdisc_tree_decrease_qlen net/sched/sch_api.c Date: Tue, 01 Dec 2015 06:15:37 -0800 Message-ID: <1448979337.25582.22.camel@edumazet-glaptop2.roam.corp.google.com> References: <20151201010005.GA23175@Fux-PC> <20151201111943.GA4036@Fux-PC> <1448978807.25582.19.camel@edumazet-glaptop2.roam.corp.google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: Cong Wang , netdev , Jamal Hadi Salim , David Miller , spender@grsecurity.net, pageexec@freemail.hu, re.emese@gmail.com To: Daniele Fucini Return-path: Received: from mail-pa0-f48.google.com ([209.85.220.48]:35455 "EHLO mail-pa0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754336AbbLAOPj (ORCPT ); Tue, 1 Dec 2015 09:15:39 -0500 Received: by pacej9 with SMTP id ej9so6561749pac.2 for ; Tue, 01 Dec 2015 06:15:38 -0800 (PST) In-Reply-To: <1448978807.25582.19.camel@edumazet-glaptop2.roam.corp.google.com> Sender: netdev-owner@vger.kernel.org List-ID: On Tue, 2015-12-01 at 06:06 -0800, Eric Dumazet wrote: > On Tue, 2015-12-01 at 12:19 +0100, Daniele Fucini wrote: > > Thanks for the reply. Here's the output of `tc qdisc show`: > > https://gist.github.com/1847102c8fe08f63e9e7 > > > > Daniele > > > > > > On Mon, Nov 30, 2015 at 08:50:29PM -0800, Cong Wang wrote: > > > On Mon, Nov 30, 2015 at 5:00 PM, Daniele Fucini wrote: > > > > Hello, > > > > > > > > I'm using a Grsecurity patched kernel (version 4.2.6-201511282239) and > > > > I'm getting system freezes due to PaX detecting a size overflow in > > > > function qdisc_tree_decrease_qlen net/sched/sch_api.c:769 whenever I use > > > > Transmission BitTorrent client. > > > > > > > > On the Grsecurity forum I was told it's probably an unintended integer > > > > underflow that I should report upstream. > > > > > > > > Here's the relevant log: > > > > https://gist.github.com/cf54ccbb12ea65e146d4 > > > > > > > > > > Looks like we miss some sch->q.qlen accounting somewhere... > > > > > > What is your qdisc setup? Is your fq_codel the default one or you installed it > > > or some other qdisc somewhere (`tc qdisc show` could tell)? > > > > > > I will take a deeper look tomorrow, or maybe Jamal could find something > > > before I wake up. ;) > > Hmm... I do not think we ever took care of MQ in > qdisc_tree_decrease_qlen() Please try following fix : diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index f43c8f33f09e..72f2c1dfdcde 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -759,6 +759,8 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n) WARN_ON(parentid != TC_H_ROOT); return; } + if (sch->flags & TCQ_F_MQROOT) + return; cops = sch->ops->cl_ops; if (cops->qlen_notify) { cl = cops->get(sch, parentid);