* [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key
@ 2024-07-25 9:27 Eric Dumazet
2024-07-25 10:03 ` Simon Horman
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Eric Dumazet @ 2024-07-25 9:27 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Jamal Hadi Salim, Cong Wang, Jiri Pirko, netdev, eric.dumazet,
Eric Dumazet, syzbot+1b5e4e187cc586d05ea0, Xin Long
Blamed commit increased lookup key size from 2 bytes to 16 bytes,
because zones_ht_key got a struct net pointer.
Make sure rhashtable_lookup() is not using the padding bytes
which are not initialized.
BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
__rhashtable_lookup include/linux/rhashtable.h:607 [inline]
rhashtable_lookup include/linux/rhashtable.h:646 [inline]
rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425
tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488
tcf_action_add net/sched/act_api.c:2061 [inline]
tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118
rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647
netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665
netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
____sys_sendmsg+0x877/0xb60 net/socket.c:2597
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
__sys_sendmsg net/socket.c:2680 [inline]
__do_sys_sendmsg net/socket.c:2689 [inline]
__se_sys_sendmsg net/socket.c:2687 [inline]
__x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable key created at:
tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324
tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
Fixes: 88c67aeb1407 ("sched: act_ct: add netns into the key of tcf_ct_flow_table")
Reported-by: syzbot+1b5e4e187cc586d05ea0@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Xin Long <lucien.xin@gmail.com>
---
net/sched/act_ct.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 113b907da0f757af7be920cc9b3a1b1c769f5804..3ba8e7e739b58a96e66ca64d38bff758500df3e1 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -44,6 +44,8 @@ static DEFINE_MUTEX(zones_mutex);
struct zones_ht_key {
struct net *net;
u16 zone;
+ /* Note : pad[] must be the last field. */
+ u8 pad[];
};
struct tcf_ct_flow_table {
@@ -60,7 +62,7 @@ struct tcf_ct_flow_table {
static const struct rhashtable_params zones_params = {
.head_offset = offsetof(struct tcf_ct_flow_table, node),
.key_offset = offsetof(struct tcf_ct_flow_table, key),
- .key_len = sizeof_field(struct tcf_ct_flow_table, key),
+ .key_len = offsetof(struct zones_ht_key, pad),
.automatic_shrinking = true,
};
--
2.45.2.1089.g2a221341d9-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key
2024-07-25 9:27 [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key Eric Dumazet
@ 2024-07-25 10:03 ` Simon Horman
2024-07-25 14:30 ` Xin Long
2024-07-26 10:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Simon Horman @ 2024-07-25 10:03 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S. Miller, Jakub Kicinski, Paolo Abeni, Jamal Hadi Salim,
Cong Wang, Jiri Pirko, netdev, eric.dumazet,
syzbot+1b5e4e187cc586d05ea0, Xin Long
On Thu, Jul 25, 2024 at 09:27:45AM +0000, Eric Dumazet wrote:
> Blamed commit increased lookup key size from 2 bytes to 16 bytes,
> because zones_ht_key got a struct net pointer.
>
> Make sure rhashtable_lookup() is not using the padding bytes
> which are not initialized.
>
> BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
> BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
> BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
> BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
> BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
> rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
> __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
> rhashtable_lookup include/linux/rhashtable.h:646 [inline]
> rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
> tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
> tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
> tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425
> tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488
> tcf_action_add net/sched/act_api.c:2061 [inline]
> tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118
> rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647
> netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
> rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665
> netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
> netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
> netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:745
> ____sys_sendmsg+0x877/0xb60 net/socket.c:2597
> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
> __sys_sendmsg net/socket.c:2680 [inline]
> __do_sys_sendmsg net/socket.c:2689 [inline]
> __se_sys_sendmsg net/socket.c:2687 [inline]
> __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
> x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Local variable key created at:
> tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324
> tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
>
> Fixes: 88c67aeb1407 ("sched: act_ct: add netns into the key of tcf_ct_flow_table")
> Reported-by: syzbot+1b5e4e187cc586d05ea0@syzkaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key
2024-07-25 9:27 [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key Eric Dumazet
2024-07-25 10:03 ` Simon Horman
@ 2024-07-25 14:30 ` Xin Long
2024-07-26 10:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Xin Long @ 2024-07-25 14:30 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Jamal Hadi Salim,
Cong Wang, Jiri Pirko, netdev, eric.dumazet,
syzbot+1b5e4e187cc586d05ea0
On Thu, Jul 25, 2024 at 5:27 AM Eric Dumazet <edumazet@google.com> wrote:
>
> Blamed commit increased lookup key size from 2 bytes to 16 bytes,
> because zones_ht_key got a struct net pointer.
>
> Make sure rhashtable_lookup() is not using the padding bytes
> which are not initialized.
>
> BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
> BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
> BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
> BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
> BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
> rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
> __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
> rhashtable_lookup include/linux/rhashtable.h:646 [inline]
> rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
> tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
> tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
> tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425
> tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488
> tcf_action_add net/sched/act_api.c:2061 [inline]
> tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118
> rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647
> netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
> rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665
> netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
> netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
> netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:745
> ____sys_sendmsg+0x877/0xb60 net/socket.c:2597
> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
> __sys_sendmsg net/socket.c:2680 [inline]
> __do_sys_sendmsg net/socket.c:2689 [inline]
> __se_sys_sendmsg net/socket.c:2687 [inline]
> __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
> x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Local variable key created at:
> tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324
> tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
>
> Fixes: 88c67aeb1407 ("sched: act_ct: add netns into the key of tcf_ct_flow_table")
> Reported-by: syzbot+1b5e4e187cc586d05ea0@syzkaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Thanks, didn't know this doesn't get padding bytes initialized:
struct zones_ht_key key = { .net = net, .zone = params->zone };
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key
2024-07-25 9:27 [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key Eric Dumazet
2024-07-25 10:03 ` Simon Horman
2024-07-25 14:30 ` Xin Long
@ 2024-07-26 10:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2024-07-26 10:30 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, jhs, xiyou.wangcong, jiri, netdev,
eric.dumazet, syzbot+1b5e4e187cc586d05ea0, lucien.xin
Hello:
This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:
On Thu, 25 Jul 2024 09:27:45 +0000 you wrote:
> Blamed commit increased lookup key size from 2 bytes to 16 bytes,
> because zones_ht_key got a struct net pointer.
>
> Make sure rhashtable_lookup() is not using the padding bytes
> which are not initialized.
>
> BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
> BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
> BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
> BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
> BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
> rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
> __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
> rhashtable_lookup include/linux/rhashtable.h:646 [inline]
> rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
> tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
> tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
> tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425
> tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488
> tcf_action_add net/sched/act_api.c:2061 [inline]
> tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118
> rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647
> netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
> rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665
> netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
> netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
> netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x30f/0x380 net/socket.c:745
> ____sys_sendmsg+0x877/0xb60 net/socket.c:2597
> ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
> __sys_sendmsg net/socket.c:2680 [inline]
> __do_sys_sendmsg net/socket.c:2689 [inline]
> __se_sys_sendmsg net/socket.c:2687 [inline]
> __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
> x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> [...]
Here is the summary with links:
- [net] sched: act_ct: take care of padding in struct zones_ht_key
https://git.kernel.org/netdev/net/c/2191a54f6322
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-07-26 10:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-07-25 9:27 [PATCH net] sched: act_ct: take care of padding in struct zones_ht_key Eric Dumazet
2024-07-25 10:03 ` Simon Horman
2024-07-25 14:30 ` Xin Long
2024-07-26 10:30 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).