netdev - Re: [PATCH net] net, sched: fix panic when updating miniq {b,q}stats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 16 Jan 2018 15:03:46 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     daniel@...earbox.net
Cc:     netdev@...r.kernel.org, sandipan@...ux.vnet.ibm.com,
        bhole_prashant_q7@....ntt.co.jp, john.fastabend@...il.com,
        ast@...nel.org, jiri@...nulli.us
Subject: Re: [PATCH net] net, sched: fix panic when updating miniq
 {b,q}stats

From: Daniel Borkmann <daniel@...earbox.net>
Date: Mon, 15 Jan 2018 23:12:09 +0100

> While working on fixing another bug, I ran into the following panic
> on arm64 by simply attaching clsact qdisc, adding a filter and running
> traffic on ingress to it:
...
> Reason is that sch_ingress and sch_clsact are doing mini_qdisc_pair_init()
> which sets up miniq pointers to cpu_{b,q}stats from the underlying qdisc.
> Problem is that this cannot work since they are actually set up right after
> the qdisc ->init() callback in qdisc_create(), so first packet going into
> sch_handle_ingress() tries to call mini_qdisc_bstats_cpu_update() and we
> therefore panic.
> 
> In order to fix this, allocation of {b,q}stats needs to happen before we
> call into ->init(). In net-next, there's already such option through commit
> d59f5ffa59d8 ("net: sched: a dflt qdisc may be used with per cpu stats").
> However, the bug needs to be fixed in net still for 4.15. Thus, include
> these bits to reduce any merge churn and reuse the static_flags field to
> set TCQ_F_CPUSTATS, and remove the allocation from qdisc_create() since
> there is no other user left. Prashant Bhole ran into the same issue but
> for net-next, thus adding him below as well as co-author. Same issue was
> also reported by Sandipan Das when using bcc.
> 
> Fixes: 46209401f8f6 ("net: core: introduce mini_Qdisc and eliminate usage of tp->q for clsact fastpath")
> Reference: https://lists.iovisor.org/pipermail/iovisor-dev/2018-January/001190.html
> Reported-by: Sandipan Das <sandipan@...ux.vnet.ibm.com>
> Co-authored-by: Prashant Bhole <bhole_prashant_q7@....ntt.co.jp>
> Co-authored-by: John Fastabend <john.fastabend@...il.com>
> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>

Applied, thanks Daniel.