From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Roman Mashak <mrv@mojatatu.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.15 17/47] net sched actions: return explicit error when tunnel_key mode is not specified
Date: Thu, 29 Mar 2018 19:59:58 +0200 [thread overview]
Message-ID: <20180329175730.359995361@linuxfoundation.org> (raw)
In-Reply-To: <20180329175729.225211114@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Mashak <mrv@mojatatu.com>
[ Upstream commit 51d4740f88affd85d49c04e3c9cd129c0e33bcb9 ]
If set/unset mode of the tunnel_key action is not provided, ->init() still
returns 0, and the caller proceeds with bogus 'struct tc_action *' object,
this results in crash:
% tc actions add action tunnel_key src_ip 1.1.1.1 dst_ip 2.2.2.1 id 7 index 1
[ 35.805515] general protection fault: 0000 [#1] SMP PTI
[ 35.806161] Modules linked in: act_tunnel_key kvm_intel kvm irqbypass
crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64
crypto_simd glue_helper cryptd serio_raw
[ 35.808233] CPU: 1 PID: 428 Comm: tc Not tainted 4.16.0-rc4+ #286
[ 35.808929] RIP: 0010:tcf_action_init+0x90/0x190
[ 35.809457] RSP: 0018:ffffb8edc068b9a0 EFLAGS: 00010206
[ 35.810053] RAX: 1320c000000a0003 RBX: 0000000000000001 RCX: 0000000000000000
[ 35.810866] RDX: 0000000000000070 RSI: 0000000000007965 RDI: ffffb8edc068b910
[ 35.811660] RBP: ffffb8edc068b9d0 R08: 0000000000000000 R09: ffffb8edc068b808
[ 35.812463] R10: ffffffffc02bf040 R11: 0000000000000040 R12: ffffb8edc068bb38
[ 35.813235] R13: 0000000000000000 R14: 0000000000000000 R15: ffffb8edc068b910
[ 35.814006] FS: 00007f3d0d8556c0(0000) GS:ffff91d1dbc40000(0000)
knlGS:0000000000000000
[ 35.814881] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 35.815540] CR2: 000000000043f720 CR3: 0000000019248001 CR4: 00000000001606a0
[ 35.816457] Call Trace:
[ 35.817158] tc_ctl_action+0x11a/0x220
[ 35.817795] rtnetlink_rcv_msg+0x23d/0x2e0
[ 35.818457] ? __slab_alloc+0x1c/0x30
[ 35.819079] ? __kmalloc_node_track_caller+0xb1/0x2b0
[ 35.819544] ? rtnl_calcit.isra.30+0xe0/0xe0
[ 35.820231] netlink_rcv_skb+0xce/0x100
[ 35.820744] netlink_unicast+0x164/0x220
[ 35.821500] netlink_sendmsg+0x293/0x370
[ 35.822040] sock_sendmsg+0x30/0x40
[ 35.822508] ___sys_sendmsg+0x2c5/0x2e0
[ 35.823149] ? pagecache_get_page+0x27/0x220
[ 35.823714] ? filemap_fault+0xa2/0x640
[ 35.824423] ? page_add_file_rmap+0x108/0x200
[ 35.825065] ? alloc_set_pte+0x2aa/0x530
[ 35.825585] ? finish_fault+0x4e/0x70
[ 35.826140] ? __handle_mm_fault+0xbc1/0x10d0
[ 35.826723] ? __sys_sendmsg+0x41/0x70
[ 35.827230] __sys_sendmsg+0x41/0x70
[ 35.827710] do_syscall_64+0x68/0x120
[ 35.828195] entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[ 35.828859] RIP: 0033:0x7f3d0ca4da67
[ 35.829331] RSP: 002b:00007ffc9f284338 EFLAGS: 00000246 ORIG_RAX:
000000000000002e
[ 35.830304] RAX: ffffffffffffffda RBX: 00007ffc9f284460 RCX: 00007f3d0ca4da67
[ 35.831247] RDX: 0000000000000000 RSI: 00007ffc9f2843b0 RDI: 0000000000000003
[ 35.832167] RBP: 000000005aa6a7a9 R08: 0000000000000001 R09: 0000000000000000
[ 35.833075] R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000000
[ 35.833997] R13: 00007ffc9f2884c0 R14: 0000000000000001 R15: 0000000000674640
[ 35.834923] Code: 24 30 bb 01 00 00 00 45 31 f6 eb 5e 8b 50 08 83 c2 07 83 e2
fc 83 c2 70 49 8b 07 48 8b 40 70 48 85 c0 74 10 48 89 14 24 4c 89 ff <ff> d0 48
8b 14 24 48 01 c2 49 01 d6 45 85 ed 74 05 41 83 47 2c
[ 35.837442] RIP: tcf_action_init+0x90/0x190 RSP: ffffb8edc068b9a0
[ 35.838291] ---[ end trace a095c06ee4b97a26 ]---
Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/act_tunnel_key.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -153,6 +153,7 @@ static int tunnel_key_init(struct net *n
metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
break;
default:
+ ret = -EINVAL;
goto err_out;
}
next prev parent reply other threads:[~2018-03-29 18:02 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-29 17:59 [PATCH 4.15 00/47] 4.15.15-stable review Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 01/47] net: dsa: Fix dsa_is_user_port() test inversion Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 02/47] openvswitch: meter: fix the incorrect calculation of max delta_t Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 03/47] qed: Fix MPA unalign flow in case header is split across two packets Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 04/47] tcp: purge write queue upon aborting the connection Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 05/47] qed: Fix non TCP packets should be dropped on iWARP ll2 connection Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 06/47] sysfs: symlink: export sysfs_create_link_nowarn() Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 07/47] net: phy: relax error checking when creating sysfs link netdev->phydev Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 08/47] devlink: Remove redundant free on error path Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 09/47] macvlan: filter out unsupported feature flags Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 10/47] net: ipv6: keep sk status consistent after datagram connect failure Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 11/47] ipv6: old_dport should be a __be16 in __ip6_datagram_connect() Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 12/47] ipv6: sr: fix NULL pointer dereference when setting encap source address Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 13/47] ipv6: sr: fix scheduling in RCU when creating seg6 lwtunnel state Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 14/47] mlxsw: spectrum_buffers: Set a minimum quota for CPU port traffic Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 15/47] net: phy: Tell caller result of phy_change() Greg Kroah-Hartman
2018-03-29 17:59 ` [PATCH 4.15 16/47] ipv6: Reflect MTU changes on PMTU of exceptions for MTU-less routes Greg Kroah-Hartman
2018-03-29 17:59 ` Greg Kroah-Hartman [this message]
2018-03-29 17:59 ` [PATCH 4.15 18/47] ppp: avoid loop in xmit recursion detection code Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 19/47] rhashtable: Fix rhlist duplicates insertion Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 20/47] test_rhashtable: add test case for rhltable with duplicate objects Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 21/47] kcm: lock lower socket in kcm_attach Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 22/47] sch_netem: fix skb leak in netem_enqueue() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 23/47] ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 24/47] net: use skb_to_full_sk() in skb_update_prio() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 25/47] net: Fix hlist corruptions in inet_evict_bucket() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 26/47] s390/qeth: free netdevice when removing a card Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 27/47] s390/qeth: when thread completes, wake up all waiters Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 28/47] s390/qeth: lock read device while queueing next buffer Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 29/47] s390/qeth: on channel error, reject further cmd requests Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 30/47] soc/fsl/qbman: fix issue in qman_delete_cgr_safe() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 31/47] dpaa_eth: fix error in dpaa_remove() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 32/47] dpaa_eth: remove duplicate initialization Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 33/47] dpaa_eth: increment the RX dropped counter when needed Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 34/47] dpaa_eth: remove duplicate increment of the tx_errors counter Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 35/47] dccp: check sk for closed state in dccp_sendmsg() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 36/47] ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 37/47] l2tp: do not accept arbitrary sockets Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 38/47] net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 40/47] net: fec: Fix unbalanced PM runtime calls Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 41/47] net/iucv: Free memory obtained by kzalloc Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 42/47] netlink: avoid a double skb free in genlmsg_mcast() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 43/47] net: Only honor ifindex in IP_PKTINFO if non-0 Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 44/47] net: systemport: Rewrite __bcm_sysport_tx_reclaim() Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 45/47] qede: Fix qedr link update Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 46/47] skbuff: Fix not waking applications when errors are enqueued Greg Kroah-Hartman
2018-03-29 18:00 ` [PATCH 4.15 47/47] team: Fix double free in error path Greg Kroah-Hartman
2018-03-29 23:09 ` [PATCH 4.15 00/47] 4.15.15-stable review Shuah Khan
2018-03-30 9:02 ` Greg Kroah-Hartman
2018-03-30 8:11 ` Naresh Kamboju
2018-03-30 9:08 ` Greg Kroah-Hartman
2018-03-30 15:20 ` Guenter Roeck
2018-03-31 7:22 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180329175730.359995361@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mrv@mojatatu.com \
--cc=stable@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).