[PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[Davide Caratti]

trying to configure TC 'act_gate' rules with invalid control actions, the
following splat can be observed:

 general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
 CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168
 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
 RIP: 0010:hrtimer_active+0x56/0x290
 [...]
  Call Trace:
  hrtimer_try_to_cancel+0x6d/0x330
  hrtimer_cancel+0x11/0x20
  tcf_gate_cleanup+0x15/0x30 [act_gate]
  tcf_action_cleanup+0x58/0x170
  __tcf_action_put+0xb0/0xe0
  __tcf_idr_release+0x68/0x90
  tcf_gate_init+0x7c7/0x19a0 [act_gate]
  tcf_action_init_1+0x60f/0x960
  tcf_action_init+0x157/0x2a0
  tcf_action_add+0xd9/0x2f0
  tc_ctl_action+0x2a3/0x39d
  rtnetlink_rcv_msg+0x5f3/0x920
  netlink_rcv_skb+0x121/0x350
  netlink_unicast+0x439/0x630
  netlink_sendmsg+0x714/0xbf0
  sock_sendmsg+0xe2/0x110
  ____sys_sendmsg+0x5b4/0x890
  ___sys_sendmsg+0xe9/0x160
  __sys_sendmsg+0xd3/0x170
  do_syscall_64+0x9a/0x370
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
ensuring to call hrtimer_cancel() only if clockid is valid, and the timer
has been initialized. After fixing this splat, the same error path causes
another problem:

 general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 CPU: 1 PID: 980 Comm: tc Not tainted 5.7.0-rc6+ #168
 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
 RIP: 0010:release_entry_list+0x4a/0x240 [act_gate]
 [...]
 Call Trace:
  tcf_action_cleanup+0x58/0x170
  __tcf_action_put+0xb0/0xe0
  __tcf_idr_release+0x68/0x90
  tcf_gate_init+0x7ab/0x19a0 [act_gate]
  tcf_action_init_1+0x60f/0x960
  tcf_action_init+0x157/0x2a0
  tcf_action_add+0xd9/0x2f0
  tc_ctl_action+0x2a3/0x39d
  rtnetlink_rcv_msg+0x5f3/0x920
  netlink_rcv_skb+0x121/0x350
  netlink_unicast+0x439/0x630
  netlink_sendmsg+0x714/0xbf0
  sock_sendmsg+0xe2/0x110
  ____sys_sendmsg+0x5b4/0x890
  ___sys_sendmsg+0xe9/0x160
  __sys_sendmsg+0xd3/0x170
  do_syscall_64+0x9a/0x370
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

the problem is similar: tcf_action_cleanup() was trying to release a list
without initializing it first. Ensure that INIT_LIST_HEAD() is called for
every newly created 'act_gate' action, same as what was done to 'act_ife'
with commit 44c23d71599f ("net/sched: act_ife: initalize ife->metalist
earlier").

Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
CC: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 net/sched/act_gate.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c
index 35fc48795541c..9c628591f452c 100644
--- a/net/sched/act_gate.c
+++ b/net/sched/act_gate.c
@@ -331,6 +331,10 @@ static int tcf_gate_init(struct net *net, struct nlattr *nla,
 		tcf_idr_release(*a, bind);
 		return -EEXIST;
 	}
+	if (ret == ACT_P_CREATED) {
+		to_gate(*a)->param.tcfg_clockid = -1;
+		INIT_LIST_HEAD(&(to_gate(*a)->param.entries));
+	}
 
 	if (tb[TCA_GATE_PRIORITY])
 		prio = nla_get_s32(tb[TCA_GATE_PRIORITY]);
@@ -377,7 +381,6 @@ static int tcf_gate_init(struct net *net, struct nlattr *nla,
 			goto chain_put;
 	}
 
-	INIT_LIST_HEAD(&p->entries);
 	if (tb[TCA_GATE_ENTRY_LIST]) {
 		err = parse_gate_list(tb[TCA_GATE_ENTRY_LIST], p, extack);
 		if (err < 0)
@@ -449,9 +452,9 @@ static void tcf_gate_cleanup(struct tc_action *a)
 	struct tcf_gate *gact = to_gate(a);
 	struct tcf_gate_params *p;
 
-	hrtimer_cancel(&gact->hitimer);
-
 	p = &gact->param;
+	if (p->tcfg_clockid != -1)
+		hrtimer_cancel(&gact->hitimer);
 
 	release_entry_list(&p->entries);
 }
-- 
2.26.2

Re: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[David Miller]

From: Davide Caratti <dcaratti@redhat.com>
Date: Fri, 29 May 2020 00:05:32 +0200

> trying to configure TC 'act_gate' rules with invalid control actions, the
> following splat can be observed:
> 
>  general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
>  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>  CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168
>  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
>  RIP: 0010:hrtimer_active+0x56/0x290
>  [...]
>   Call Trace:
>   hrtimer_try_to_cancel+0x6d/0x330
 ...
> this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
> ensuring to call hrtimer_cancel() only if clockid is valid, and the timer
> has been initialized. After fixing this splat, the same error path causes
> another problem:
> 
>  general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
>  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
>  CPU: 1 PID: 980 Comm: tc Not tainted 5.7.0-rc6+ #168
>  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
>  RIP: 0010:release_entry_list+0x4a/0x240 [act_gate]
>  [...]
>  Call Trace:
>   tcf_action_cleanup+0x58/0x170
  ...
> the problem is similar: tcf_action_cleanup() was trying to release a list
> without initializing it first. Ensure that INIT_LIST_HEAD() is called for
> every newly created 'act_gate' action, same as what was done to 'act_ife'
> with commit 44c23d71599f ("net/sched: act_ife: initalize ife->metalist
> earlier").
> 
> Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
> CC: Ivan Vecera <ivecera@redhat.com>
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Applied, thanks.

Re: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[Cong Wang]

On Mon, Jun 1, 2020 at 11:40 AM David Miller <davem@davemloft.net> wrote:
>
> From: Davide Caratti <dcaratti@redhat.com>
> Date: Fri, 29 May 2020 00:05:32 +0200
>
> > trying to configure TC 'act_gate' rules with invalid control actions, the
> > following splat can be observed:
> >
> >  general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> >  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> >  CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168
> >  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
> >  RIP: 0010:hrtimer_active+0x56/0x290
> >  [...]
> >   Call Trace:
> >   hrtimer_try_to_cancel+0x6d/0x330
>  ...
> > this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
> > ensuring to call hrtimer_cancel() only if clockid is valid, and the timer
> > has been initialized. After fixing this splat, the same error path causes
> > another problem:
> >
> >  general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
> >  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> >  CPU: 1 PID: 980 Comm: tc Not tainted 5.7.0-rc6+ #168
> >  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
> >  RIP: 0010:release_entry_list+0x4a/0x240 [act_gate]
> >  [...]
> >  Call Trace:
> >   tcf_action_cleanup+0x58/0x170
>   ...
> > the problem is similar: tcf_action_cleanup() was trying to release a list
> > without initializing it first. Ensure that INIT_LIST_HEAD() is called for
> > every newly created 'act_gate' action, same as what was done to 'act_ife'
> > with commit 44c23d71599f ("net/sched: act_ife: initalize ife->metalist
> > earlier").
> >
> > Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
> > CC: Ivan Vecera <ivecera@redhat.com>
> > Signed-off-by: Davide Caratti <dcaratti@redhat.com>
>
> Applied, thanks.

You applied a wrong version. There is a V2 of this patch, and I had some
review for it.

Thanks.

Re: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[Davide Caratti]

On Mon, 2020-06-01 at 11:37 -0700, David Miller wrote:
> From: Davide Caratti <dcaratti@redhat.com>
> Date: Fri, 29 May 2020 00:05:32 +0200
> 
> > trying to configure TC 'act_gate' rules with invalid control actions, the
> > following splat can be observed:
> > 
> >  general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
> >  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> >  CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168
> >  Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
> >  RIP: 0010:hrtimer_active+0x56/0x290
> >  [...]
> >   Call Trace:
> >   hrtimer_try_to_cancel+0x6d/0x330
>  ...
> > this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
> > ensuring to call hrtimer_cancel() only if clockid is valid, and the timer
> > has been initialized. After fixing this splat, the same error path causes
> > another problem:
[...]

> Applied, thanks.

hello Dave,

for this patch I will probably need to send a follow-up, because
the TC action overwrite case probably has still some issues [1] [2].
I can do that targeting the 'net' tree, unless Po or Cong have some
objections.

Ok?

thank you in advance,
-- 
davide


[1] https://lore.kernel.org/netdev/CAM_iQpVesOZ0kQ2OWHss1kG3O5tvYUYETK4A3LW9doH5ZFQjmw@mail.gmail.com/ 
[2] https://lore.kernel.org/netdev/696c630f8c72f2a6a0674b69921fd500f1d5d4d1.camel@redhat.com/

Re: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[David Miller]

From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Mon, 1 Jun 2020 11:48:54 -0700

> You applied a wrong version. There is a V2 of this patch, and I had some
> review for it.

I just noticed that, sorry.

Please send follow-ups, as needed.

Re: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[Cong Wang]

On Mon, Jun 1, 2020 at 11:49 AM Davide Caratti <dcaratti@redhat.com> wrote:
> hello Dave,
>
> for this patch I will probably need to send a follow-up, because
> the TC action overwrite case probably has still some issues [1] [2].
> I can do that targeting the 'net' tree, unless Po or Cong have some
> objections.
>
> Ok?

Sounds reasonable. It is a bug fix anyway.

Thanks.

Re: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[Davide Caratti]

hi Po Liu,

On Fri, 2020-05-29 at 02:43 +0000, Po Liu wrote:
> Can you share the test step? 

sure, an invalid value of the control action is sufficient:

# tc action add action gate index 2 clockid CLOCK_TAI goto chain 42

> Clockid by default is set with CLOCK_TAI.

not in the error path of tcf_gate_init(), see below:

> And INIT_LIST_HEAD() also called in the init.

...ditto. In the error path of tcf_gate_init(), these two initializations
are not done. Looking at the call trace, validation of the control action
fails here:

365         err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
366         if (err < 0)
367                 goto release_idr;

then, the execution jumps to 'release_idr' thus skipping INIT_LIST_HEAD()
and hrtimer_init():

442 release_idr:
443         tcf_idr_release(*a, bind);
444         return err;

because of this, tcf_gate_cleanup() is invoked with

	'to_gate(*a)->param.entries'

all filled with zeros, and the same applies to

	'to_gate(*a)->hitimer'

and 

	'to_gate(*a)->param.tfcg_clockid'

> So I think maybe there is better method to avoid the duplicated code.

I'm not sure of what duplication you are referring to, but I suspect it's
those to_gate(*a) inside the if (ret == ACT_P_CREATED) { ... } statement:
I'm sending right now a v2 where I moved the assignment of 'gact' earlier.

Looking again at the error path of tcf_gate_init(), I suspect there is
another bug: the validation of 'tcfg_cycletime' and 'TCA_GATE_ENTRY_LIST'
is suspicious, because it overwrites the action's configuration with wrong
ones, thus causing semi-configured rules.
But it's unrelated to this kernel panic, so probably it deserves a
separate patch (and moreover, I don't have yet scripts that to verify it).
But I can follow-up on this in the next days, if you want.

thanks for looking at this,
-- 
davide

RE: [PATCH net-next] net/sched: fix a couple of splats in the error path of tfc_gate_init()

[Po Liu]

Hi Davide,


> -----Original Message-----
> From: Davide Caratti <dcaratti@redhat.com>
> Sent: 2020年5月29日 6:06
> To: Jamal Hadi Salim <jhs@mojatatu.com>; Po Liu <po.liu@nxp.com>;
> netdev@vger.kernel.org; David S. Miller <davem@davemloft.net>
> Cc: Ivan Vecera <ivecera@redhat.com>
> Subject: [PATCH net-next] net/sched: fix a couple of splats in the
> error path of tfc_gate_init()
> 
> trying to configure TC 'act_gate' rules with invalid control actions, the
> following splat can be observed:
> 
>  general protection fault, probably for non-canonical address
> 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
>  KASAN: null-ptr-deref in range [0x0000000000000010-
> 0x0000000000000017]
>  CPU: 1 PID: 2143 Comm: tc Not tainted 5.7.0-rc6+ #168  Hardware name:
> Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
>  RIP: 0010:hrtimer_active+0x56/0x290
>  [...]
>   Call Trace:
>   hrtimer_try_to_cancel+0x6d/0x330
>   hrtimer_cancel+0x11/0x20
>   tcf_gate_cleanup+0x15/0x30 [act_gate]
>   tcf_action_cleanup+0x58/0x170
>   __tcf_action_put+0xb0/0xe0
>   __tcf_idr_release+0x68/0x90
>   tcf_gate_init+0x7c7/0x19a0 [act_gate]
>   tcf_action_init_1+0x60f/0x960
>   tcf_action_init+0x157/0x2a0
>   tcf_action_add+0xd9/0x2f0
>   tc_ctl_action+0x2a3/0x39d
>   rtnetlink_rcv_msg+0x5f3/0x920
>   netlink_rcv_skb+0x121/0x350
>   netlink_unicast+0x439/0x630
>   netlink_sendmsg+0x714/0xbf0
>   sock_sendmsg+0xe2/0x110
>   ____sys_sendmsg+0x5b4/0x890
>   ___sys_sendmsg+0xe9/0x160
>   __sys_sendmsg+0xd3/0x170
>   do_syscall_64+0x9a/0x370
>   entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> this is caused by hrtimer_cancel(), running before hrtimer_init(). Fix it
> ensuring to call hrtimer_cancel() only if clockid is valid, and the timer has

Can you share the test step? Clockid by default is set with CLOCK_TAI. And INIT_LIST_HEAD() also called in the init.
So I think maybe there is better method to avoid the duplicated code.

> been initialized. After fixing this splat, the same error path causes another
> problem:
> 
>  general protection fault, probably for non-canonical address
> 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
>  KASAN: null-ptr-deref in range [0x0000000000000000-
> 0x0000000000000007]
>  CPU: 1 PID: 980 Comm: tc Not tainted 5.7.0-rc6+ #168  Hardware name:
> Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
>  RIP: 0010:release_entry_list+0x4a/0x240 [act_gate]  [...]  Call Trace:
>   tcf_action_cleanup+0x58/0x170
>   __tcf_action_put+0xb0/0xe0
>   __tcf_idr_release+0x68/0x90
>   tcf_gate_init+0x7ab/0x19a0 [act_gate]
>   tcf_action_init_1+0x60f/0x960
>   tcf_action_init+0x157/0x2a0
>   tcf_action_add+0xd9/0x2f0
>   tc_ctl_action+0x2a3/0x39d
>   rtnetlink_rcv_msg+0x5f3/0x920
>   netlink_rcv_skb+0x121/0x350
>   netlink_unicast+0x439/0x630
>   netlink_sendmsg+0x714/0xbf0
>   sock_sendmsg+0xe2/0x110
>   ____sys_sendmsg+0x5b4/0x890
>   ___sys_sendmsg+0xe9/0x160
>   __sys_sendmsg+0xd3/0x170
>   do_syscall_64+0x9a/0x370
>   entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> the problem is similar: tcf_action_cleanup() was trying to release a list
> without initializing it first. Ensure that INIT_LIST_HEAD() is called for every
> newly created 'act_gate' action, same as what was done to 'act_ife'
> with commit 44c23d71599f ("net/sched: act_ife: initalize ife->metalist
> earlier").
> 
> Fixes: a51c328df310 ("net: qos: introduce a gate control flow action")
> CC: Ivan Vecera <ivecera@redhat.com>
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> ---
>  net/sched/act_gate.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c index
> 35fc48795541c..9c628591f452c 100644
> --- a/net/sched/act_gate.c
> +++ b/net/sched/act_gate.c
> @@ -331,6 +331,10 @@ static int tcf_gate_init(struct net *net, struct
> nlattr *nla,
>                 tcf_idr_release(*a, bind);
>                 return -EEXIST;
>         }
> +       if (ret == ACT_P_CREATED) {
> +               to_gate(*a)->param.tcfg_clockid = -1;
> +               INIT_LIST_HEAD(&(to_gate(*a)->param.entries));
> +       }
> 
>         if (tb[TCA_GATE_PRIORITY])
>                 prio = nla_get_s32(tb[TCA_GATE_PRIORITY]);
> @@ -377,7 +381,6 @@ static int tcf_gate_init(struct net *net, struct nlattr
> *nla,
>                         goto chain_put;
>         }
> 
> -       INIT_LIST_HEAD(&p->entries);
>         if (tb[TCA_GATE_ENTRY_LIST]) {
>                 err = parse_gate_list(tb[TCA_GATE_ENTRY_LIST], p, extack);
>                 if (err < 0)
> @@ -449,9 +452,9 @@ static void tcf_gate_cleanup(struct tc_action *a)
>         struct tcf_gate *gact = to_gate(a);
>         struct tcf_gate_params *p;
> 
> -       hrtimer_cancel(&gact->hitimer);
> -
>         p = &gact->param;
> +       if (p->tcfg_clockid != -1)
> +               hrtimer_cancel(&gact->hitimer);
> 
>         release_entry_list(&p->entries);  }
> --
> 2.26.2

Thanks!

Br,
Po Liu