From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from youngberry.canonical.com ([91.189.89.112]:48766 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753532AbbH0WMr (ORCPT ); Thu, 27 Aug 2015 18:12:47 -0400 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Daniel Borkmann , "David S. Miller" , Kamal Mostafa Subject: [PATCH 3.19.y-ckt 051/130] sched: cls_bpf: fix panic on filter replace Date: Thu, 27 Aug 2015 15:10:42 -0700 Message-Id: <1440713521-5906-52-git-send-email-kamal@canonical.com> In-Reply-To: <1440713521-5906-1-git-send-email-kamal@canonical.com> References: <1440713521-5906-1-git-send-email-kamal@canonical.com> Sender: stable-owner@vger.kernel.org List-ID: 3.19.8-ckt6 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Borkmann commit f6bfc46da6292b630ba389592123f0dd02066172 upstream. The following test case causes a NULL pointer dereference in cls_bpf: FOO="1,6 0 0 4294967295," tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ bpf bytecode "$FOO" flowid 1:1 action drop The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") accidentally swapped the arguments of list_replace_rcu(), the old element needs to be the first argument and the new element the second. Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller Signed-off-by: Kamal Mostafa --- net/sched/cls_bpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c index f59adf8..7ef71a2 100644 --- a/net/sched/cls_bpf.c +++ b/net/sched/cls_bpf.c @@ -282,7 +282,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, goto errout; if (oldprog) { - list_replace_rcu(&prog->link, &oldprog->link); + list_replace_rcu(&oldprog->link, &prog->link); tcf_unbind_filter(tp, &oldprog->res); call_rcu(&oldprog->rcu, __cls_bpf_delete_prog); } else { -- 1.9.1