* Re: [PATCH v2] net: sched: fix crash when deleting secondary chains
2017-11-20 21:21 [PATCH v2] net: sched: fix crash when deleting secondary chains Roman Kapl
@ 2017-11-20 19:16 ` Cong Wang
2017-11-23 16:27 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Cong Wang @ 2017-11-20 19:16 UTC (permalink / raw)
To: Roman Kapl; +Cc: Linux Kernel Network Developers, Jiri Pirko
On Sun, Nov 19, 2017 at 9:36 AM, Roman Kapl <code@rkapl.cz> wrote:
> If you flush (delete) a filter chain other than chain 0 (such as when
> deleting the device), the kernel may run into a use-after-free. The
> chain refcount must not be decremented unless we are sure we are done
> with the chain.
>
> To reproduce the bug, run:
> ip link add dtest type dummy
> tc qdisc add dev dtest ingress
> tc filter add dev dtest chain 1 parent ffff: flower
> ip link del dtest
>
> Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"),
> but unless you have KAsan or luck, you won't notice it until
> commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()")
>
> Fixes: f93e1cdcf42c ("net/sched: fix filter flushing")
> Acked-by: Jiri Pirko <jiri@mellanox.com>
> Signed-off-by: Roman Kapl <code@rkapl.cz>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v2] net: sched: fix crash when deleting secondary chains
@ 2017-11-20 21:21 Roman Kapl
2017-11-20 19:16 ` Cong Wang
2017-11-23 16:27 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Roman Kapl @ 2017-11-20 21:21 UTC (permalink / raw)
To: netdev; +Cc: Roman Kapl
If you flush (delete) a filter chain other than chain 0 (such as when
deleting the device), the kernel may run into a use-after-free. The
chain refcount must not be decremented unless we are sure we are done
with the chain.
To reproduce the bug, run:
ip link add dtest type dummy
tc qdisc add dev dtest ingress
tc filter add dev dtest chain 1 parent ffff: flower
ip link del dtest
Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"),
but unless you have KAsan or luck, you won't notice it until
commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()")
Fixes: f93e1cdcf42c ("net/sched: fix filter flushing")
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Roman Kapl <code@rkapl.cz>
---
v1 -> v2: Added Fixes and Acked-by tags
The mail was original rejected by vger, this is a re-send to netdev@vger only
(with the same message ID). Sorry for any confusion.
---
net/sched/cls_api.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index ab255b421781..7d97f612c9b9 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -205,13 +205,14 @@ static void tcf_chain_head_change(struct tcf_chain *chain,
static void tcf_chain_flush(struct tcf_chain *chain)
{
- struct tcf_proto *tp;
+ struct tcf_proto *tp = rtnl_dereference(chain->filter_chain);
tcf_chain_head_change(chain, NULL);
- while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
+ while (tp) {
RCU_INIT_POINTER(chain->filter_chain, tp->next);
- tcf_chain_put(chain);
tcf_proto_destroy(tp);
+ tp = rtnl_dereference(chain->filter_chain);
+ tcf_chain_put(chain);
}
}
--
2.15.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] net: sched: fix crash when deleting secondary chains
2017-11-20 21:21 [PATCH v2] net: sched: fix crash when deleting secondary chains Roman Kapl
2017-11-20 19:16 ` Cong Wang
@ 2017-11-23 16:27 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-11-23 16:27 UTC (permalink / raw)
To: code; +Cc: netdev
From: Roman Kapl <code@rkapl.cz>
Date: Mon, 20 Nov 2017 22:21:13 +0100
> If you flush (delete) a filter chain other than chain 0 (such as when
> deleting the device), the kernel may run into a use-after-free. The
> chain refcount must not be decremented unless we are sure we are done
> with the chain.
>
> To reproduce the bug, run:
> ip link add dtest type dummy
> tc qdisc add dev dtest ingress
> tc filter add dev dtest chain 1 parent ffff: flower
> ip link del dtest
>
> Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"),
> but unless you have KAsan or luck, you won't notice it until
> commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()")
>
> Fixes: f93e1cdcf42c ("net/sched: fix filter flushing")
> Acked-by: Jiri Pirko <jiri@mellanox.com>
> Signed-off-by: Roman Kapl <code@rkapl.cz>
Applied, thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-11-23 16:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-11-20 21:21 [PATCH v2] net: sched: fix crash when deleting secondary chains Roman Kapl
2017-11-20 19:16 ` Cong Wang
2017-11-23 16:27 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.