korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-23 19:14:30 +08:00
Code Issues Packages Projects Releases Wiki Activity
edd8e41d2e
linux/net/sched
History
Nikolay Aleksandrov c2d6511e6a sch_tbf: fix two null pointer dereferences on init failure 
sch_tbf calls qdisc_watchdog_cancel() in both its ->reset and ->destroy
callbacks but it may fail before the timer is initialized due to missing
options (either not supplied by user-space or set as a default qdisc),
also q->qdisc is used by ->reset and ->destroy so we need it initialized.

Reproduce:
$ sysctl net.core.default_qdisc=tbf
$ ip l set ethX up

Crash log:
[  959.160172] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[  959.160323] IP: qdisc_reset+0xa/0x5c
[  959.160400] PGD 59cdb067
[  959.160401] P4D 59cdb067
[  959.160466] PUD 59ccb067
[  959.160532] PMD 0
[  959.160597]
[  959.160706] Oops: 0000 [#1] SMP
[  959.160778] Modules linked in: sch_tbf sch_sfb sch_prio sch_netem
[  959.160891] CPU: 2 PID: 1562 Comm: ip Not tainted 4.13.0-rc6+ #62
[  959.160998] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[  959.161157] task: ffff880059c9a700 task.stack: ffff8800376d0000
[  959.161263] RIP: 0010:qdisc_reset+0xa/0x5c
[  959.161347] RSP: 0018:ffff8800376d3610 EFLAGS: 00010286
[  959.161531] RAX: ffffffffa001b1dd RBX: ffff8800373a2800 RCX: 0000000000000000
[  959.161733] RDX: ffffffff8215f160 RSI: ffffffff8215f160 RDI: 0000000000000000
[  959.161939] RBP: ffff8800376d3618 R08: 00000000014080c0 R09: 00000000ffffffff
[  959.162141] R10: ffff8800376d3578 R11: 0000000000000020 R12: ffffffffa001d2c0
[  959.162343] R13: ffff880037538000 R14: 00000000ffffffff R15: 0000000000000001
[  959.162546] FS:  00007fcc5126b740(0000) GS:ffff88005d900000(0000) knlGS:0000000000000000
[  959.162844] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  959.163030] CR2: 0000000000000018 CR3: 000000005abc4000 CR4: 00000000000406e0
[  959.163233] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  959.163436] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  959.163638] Call Trace:
[  959.163788]  tbf_reset+0x19/0x64 [sch_tbf]
[  959.163957]  qdisc_destroy+0x8b/0xe5
[  959.164119]  qdisc_create_dflt+0x86/0x94
[  959.164284]  ? dev_activate+0x129/0x129
[  959.164449]  attach_one_default_qdisc+0x36/0x63
[  959.164623]  netdev_for_each_tx_queue+0x3d/0x48
[  959.164795]  dev_activate+0x4b/0x129
[  959.164957]  __dev_open+0xe7/0x104
[  959.165118]  __dev_change_flags+0xc6/0x15c
[  959.165287]  dev_change_flags+0x25/0x59
[  959.165451]  do_setlink+0x30c/0xb3f
[  959.165613]  ? check_chain_key+0xb0/0xfd
[  959.165782]  rtnl_newlink+0x3a4/0x729
[  959.165947]  ? rtnl_newlink+0x117/0x729
[  959.166121]  ? ns_capable_common+0xd/0xb1
[  959.166288]  ? ns_capable+0x13/0x15
[  959.166450]  rtnetlink_rcv_msg+0x188/0x197
[  959.166617]  ? rcu_read_unlock+0x3e/0x5f
[  959.166783]  ? rtnl_newlink+0x729/0x729
[  959.166948]  netlink_rcv_skb+0x6c/0xce
[  959.167113]  rtnetlink_rcv+0x23/0x2a
[  959.167273]  netlink_unicast+0x103/0x181
[  959.167439]  netlink_sendmsg+0x326/0x337
[  959.167607]  sock_sendmsg_nosec+0x14/0x3f
[  959.167772]  sock_sendmsg+0x29/0x2e
[  959.167932]  ___sys_sendmsg+0x209/0x28b
[  959.168098]  ? do_raw_spin_unlock+0xcd/0xf8
[  959.168267]  ? _raw_spin_unlock+0x27/0x31
[  959.168432]  ? __handle_mm_fault+0x651/0xdb1
[  959.168602]  ? check_chain_key+0xb0/0xfd
[  959.168773]  __sys_sendmsg+0x45/0x63
[  959.168934]  ? __sys_sendmsg+0x45/0x63
[  959.169100]  SyS_sendmsg+0x19/0x1b
[  959.169260]  entry_SYSCALL_64_fastpath+0x23/0xc2
[  959.169432] RIP: 0033:0x7fcc5097e690
[  959.169592] RSP: 002b:00007ffd0d5c7b48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  959.169887] RAX: ffffffffffffffda RBX: ffffffff810d278c RCX: 00007fcc5097e690
[  959.170089] RDX: 0000000000000000 RSI: 00007ffd0d5c7b90 RDI: 0000000000000003
[  959.170292] RBP: ffff8800376d3f98 R08: 0000000000000001 R09: 0000000000000003
[  959.170494] R10: 00007ffd0d5c7910 R11: 0000000000000246 R12: 0000000000000006
[  959.170697] R13: 000000000066f1a0 R14: 00007ffd0d5cfc40 R15: 0000000000000000
[  959.170900]  ? trace_hardirqs_off_caller+0xa7/0xcf
[  959.171076] Code: 00 41 c7 84 24 14 01 00 00 00 00 00 00 41 c7 84 24
98 00 00 00 00 00 00 00 41 5c 41 5d 41 5e 5d c3 66 66 66 66 90 55 48 89
e5 53 <48> 8b 47 18 48 89 fb 48 8b 40 48 48 85 c0 74 02 ff d0 48 8b bb
[  959.171637] RIP: qdisc_reset+0xa/0x5c RSP: ffff8800376d3610
[  959.171821] CR2: 0000000000000018

Fixes: 87b60cfacf ("net_sched: fix error recovery at qdisc creation")
Fixes: 0fbbeb1ba4 ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-08-30 15:26:12 -07:00
..
act_api.c net sched actions: rename act_get_notify() to tcf_get_notify() 2017-07-14 08:52:33 -07:00
act_bpf.c bpf: expose prog id for cls_bpf and act_bpf 2017-06-21 15:14:23 -04:00
act_connmark.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_csum.c net: use skb->csum_not_inet to identify packets needing crc32c 2017-05-19 19:21:29 -04:00
act_gact.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_ife.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_ipt.c net: sched: fix NULL pointer dereference when action calls some targets 2017-08-18 16:25:49 -07:00
act_meta_mark.c Support to encoding decoding skb mark on IFE action 2016-03-01 17:15:23 -05:00
act_meta_skbprio.c Support to encoding decoding skb prio on IFE action 2016-03-01 17:15:23 -05:00
act_meta_skbtcindex.c net sched ife action: Introduce skb tcindex metadata encap decap 2016-09-19 21:55:28 -04:00
act_mirred.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_nat.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_pedit.c net/act_pedit: fix an error code 2017-06-14 15:24:18 -04:00
act_police.c net_sched: move tcf_lock down after gen_replace_estimator() 2017-06-14 14:39:19 -04:00
act_sample.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_simple.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_skbedit.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_skbmod.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
act_tunnel_key.c net: sched: act_tunnel_key: make UDP checksum configurable 2017-06-15 14:21:03 -04:00
act_vlan.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
cls_api.c net: sched: don't do tcf_chain_flush from tcf_chain_destroy 2017-08-22 14:39:58 -07:00
cls_basic.c net_sched: move the empty tp check from ->destroy() to ->delete() 2017-04-21 13:58:15 -04:00
cls_bpf.c bpf: expose prog id for cls_bpf and act_bpf 2017-06-21 15:14:23 -04:00
cls_cgroup.c net_sched: move the empty tp check from ->destroy() to ->delete() 2017-04-21 13:58:15 -04:00
cls_flow.c net_sched: move the empty tp check from ->destroy() to ->delete() 2017-04-21 13:58:15 -04:00
cls_flower.c net: propagate tc filter chain index down the ndo_setup_tc call 2017-06-08 09:55:53 -04:00
cls_fw.c net_sched: remove useless NULL to tp->root 2017-04-21 13:58:15 -04:00
cls_matchall.c net: propagate tc filter chain index down the ndo_setup_tc call 2017-06-08 09:55:53 -04:00
cls_route.c net_sched: remove useless NULL to tp->root 2017-04-21 13:58:15 -04:00
cls_rsvp6.c
cls_rsvp.c
cls_rsvp.h net_sched: remove useless NULL to tp->root 2017-04-21 13:58:15 -04:00
cls_tcindex.c net_sched: move the empty tp check from ->destroy() to ->delete() 2017-04-21 13:58:15 -04:00
cls_u32.c net: propagate tc filter chain index down the ndo_setup_tc call 2017-06-08 09:55:53 -04:00
em_canid.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_cmp.c
em_ipset.c netfilter: x_tables: move hook state into xt_action_param structure 2016-11-03 10:56:21 +01:00
em_meta.c net: convert sock.sk_refcnt from atomic_t to refcount_t 2017-07-01 07:39:08 -07:00
em_nbyte.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_text.c net: Remove state argument from skb_find_text() 2015-02-22 15:59:54 -05:00
em_u32.c
ematch.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
Kconfig net: sched: select cls when cls_act is enabled 2017-06-05 10:56:36 -04:00
Makefile net/sched: Introduce sample tc action 2017-01-24 13:44:28 -05:00
sch_api.c net_sched: fix a refcount_t issue with noop_qdisc 2017-08-24 21:28:24 -07:00
sch_atm.c net_sched: reset pointers to tcf blocks in classful qdiscs' destructors 2017-08-15 17:16:39 -07:00
sch_blackhole.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_cbq.c sch_cbq: fix null pointer dereferences on init failure 2017-08-30 15:26:11 -07:00
sch_choke.c treewide: use kv[mz]alloc* rather than opencoded variants 2017-05-08 17:15:13 -07:00
sch_codel.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
sch_drr.c net: sched: introduce a TRAP control action 2017-06-06 12:45:23 -04:00
sch_dsmark.c net: sched: introduce a TRAP control action 2017-06-06 12:45:23 -04:00
sch_fifo.c sched: don't use skb queue helpers 2016-09-19 01:47:18 -04:00
sch_fq_codel.c sch_fq_codel: avoid double free on init failure 2017-08-30 15:26:11 -07:00
sch_fq.c mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic 2017-07-12 16:26:03 -07:00
sch_generic.c net_sched: fix a refcount_t issue with noop_qdisc 2017-08-24 21:28:24 -07:00
sch_gred.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
sch_hfsc.c sch_hfsc: fix null pointer deref and double free on init failure 2017-08-30 15:26:11 -07:00
sch_hhf.c sch_hhf: fix null pointer dereference on init failure 2017-08-30 15:26:11 -07:00
sch_htb.c sch_htb: fix crash on init failure 2017-08-30 15:26:11 -07:00
sch_ingress.c net: sched: introduce tcf block infractructure 2017-05-17 15:22:13 -04:00
sch_mq.c net: sched: make default fifo qdiscs appear in the dump 2017-03-12 22:53:02 -07:00
sch_mqprio.c net: propagate tc filter chain index down the ndo_setup_tc call 2017-06-08 09:55:53 -04:00
sch_multiq.c sch_multiq: fix double free on init failure 2017-08-30 15:26:11 -07:00
sch_netem.c sch_netem: avoid null pointer deref on init failure 2017-08-30 15:26:11 -07:00
sch_pie.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
sch_plug.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_prio.c net: sched: introduce a TRAP control action 2017-06-06 12:45:23 -04:00
sch_qfq.c net: sched: introduce a TRAP control action 2017-06-06 12:45:23 -04:00
sch_red.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
sch_sfb.c net: sched: introduce a TRAP control action 2017-06-06 12:45:23 -04:00
sch_sfq.c sch_sfq: fix null pointer dereference on init failure 2017-08-30 15:26:12 -07:00
sch_tbf.c sch_tbf: fix two null pointer dereferences on init failure 2017-08-30 15:26:12 -07:00
sch_teql.c net: make ndo_get_stats64 a void function 2017-01-08 17:51:44 -05:00