From: Sasha Levin <sashal@kernel.org>
To: Zubin Mithra <zsm@chromium.org>
Cc: stable@vger.kernel.org, gregkh@linuxfoundation.org,
groeck@chromium.org, xiyou.wangcong@gmail.com,
davem@davemloft.net
Subject: Re: [v4.14.y] net_sched: check cops->tcf_block in tc_bind_tclass()
Date: Fri, 1 Nov 2019 03:48:21 -0400 [thread overview]
Message-ID: <20191101074821.GS1554@sasha-vm> (raw)
In-Reply-To: <20191031184259.165183-1-zsm@chromium.org>
On Thu, Oct 31, 2019 at 11:42:59AM -0700, Zubin Mithra wrote:
>From: Cong Wang <xiyou.wangcong@gmail.com>
>
>commit 8b142a00edcf8422ca48b8de88d286efb500cb53 upstream
>
>At least sch_red and sch_tbf don't implement ->tcf_block()
>while still have a non-zero tc "class".
>
>Instead of adding nop implementations to each of such qdisc's,
>we can just relax the check of cops->tcf_block() in
>tc_bind_tclass(). They don't support TC filter anyway.
>
>Reported-by: syzbot+21b29db13c065852f64b@syzkaller.appspotmail.com
>Cc: Jamal Hadi Salim <jhs@mojatatu.com>
>Cc: Jiri Pirko <jiri@resnulli.us>
>Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
>Signed-off-by: David S. Miller <davem@davemloft.net>
>Signed-off-by: Zubin Mithra <zsm@chromium.org>
>---
>Notes:
>* Syzkaller triggered a NULL pointer dereference with the following
>stacktrace:
> tc_bind_tclass+0x139/0x550 net/sched/sch_api.c:1697
> tc_ctl_tclass+0x9de/0xb30 net/sched/sch_api.c:1831
> rtnetlink_rcv_msg+0x545/0x1010 net/core/rtnetlink.c:4287
> netlink_rcv_skb+0x15e/0x3a0 net/netlink/af_netlink.c:2432
> rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:4299
> netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
> netlink_unicast+0x4ac/0x6a0 net/netlink/af_netlink.c:1312
> netlink_sendmsg+0x943/0xec0 net/netlink/af_netlink.c:1877
> sock_sendmsg_nosec net/socket.c:646 [inline]
> sock_sendmsg+0xd5/0x110 net/socket.c:656
> ___sys_sendmsg+0x754/0x890 net/socket.c:2062
> __sys_sendmsg+0xd2/0x1f0 net/socket.c:2096
> C_SYSC_sendmsg net/compat.c:744 [inline]
> compat_SyS_sendmsg+0x2f/0x40 net/compat.c:742
> do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
> do_fast_syscall_32+0x3bb/0xdd1 arch/x86/entry/common.c:415
> entry_SYSENTER_compat+0x84/0x96 arch/x86/entry/entry_64_compat.S:139
>
>* This commit is present in linux-4.19.y.
>
>* Tests run: Chrome OS tryjobs, Syzkaller reproducer
Queued up for 4.14, thank you.
--
Thanks,
Sasha
prev parent reply other threads:[~2019-11-01 7:59 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-31 18:42 [v4.14.y] net_sched: check cops->tcf_block in tc_bind_tclass() Zubin Mithra
2019-11-01 7:48 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191101074821.GS1554@sasha-vm \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=groeck@chromium.org \
--cc=stable@vger.kernel.org \
--cc=xiyou.wangcong@gmail.com \
--cc=zsm@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox