netdev - [PATCH 1/1] net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20090602181148.e01f0417.usui@mxm.nes.nec.co.jp>
Date:	Tue, 2 Jun 2009 18:11:48 +0900
From:	Minoru Usui <usui@....nes.nec.co.jp>
To:	netdev@...r.kernel.org, containers@...ts.linux-foundation.org
Cc:	Jarek Poplawski <jarkao2@...il.com>, hadi@...erus.ca
Subject: [PATCH 1/1] net_cls: fix unconfigured struct tcf_proto keeps
 chaining and avoid kernel panic when we use cls_cgroup

net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup

This patch fixes a bug which unconfigured struct tcf_proto keeps chaining in tc_ctl_tfilter(),
and avoids kernel panic in cls_cgroup_classify() when we use cls_cgroup.

When we execute 'tc filter add', tcf_proto is allocated, initialized by classifier's init(), 
and chained.
After it's chained, tc_ctl_tfilter() calls classifier's change(). 
When classifier's change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto. 

In addition, cls_cgroup is initialized in change() not in init().
It accesses unconfigured struct tcf_proto which is chained before change(), then hits Oops.

Signed-off-by: Minoru Usui <usui@....nes.nec.co.jp>
Signed-off-by: Jarek Poplawski <jarkao2@...il.com>
Signed-off-by: Jamal Hadi Salim <hadi@...erus.ca>
Tested-by: Minoru Usui <usui@....nes.nec.co.jp>

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 0759f32..09cdcdf 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -135,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
 	unsigned long cl;
 	unsigned long fh;
 	int err;
+	int tp_created = 0;
 
 	if (net != &init_net)
 		return -EINVAL;
@@ -266,10 +267,7 @@ replay:
 			goto errout;
 		}
 
-		spin_lock_bh(root_lock);
-		tp->next = *back;
-		*back = tp;
-		spin_unlock_bh(root_lock);
+		tp_created = 1;
 
 	} else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
 		goto errout;
@@ -296,8 +294,11 @@ replay:
 		switch (n->nlmsg_type) {
 		case RTM_NEWTFILTER:
 			err = -EEXIST;
-			if (n->nlmsg_flags & NLM_F_EXCL)
+			if (n->nlmsg_flags & NLM_F_EXCL) {
+				if (tp_created)
+					tcf_destroy(tp);
 				goto errout;
+			}
 			break;
 		case RTM_DELTFILTER:
 			err = tp->ops->delete(tp, fh);
@@ -314,8 +315,18 @@ replay:
 	}
 
 	err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
-	if (err == 0)
+	if (err == 0) {
+		if (tp_created) {
+			spin_lock_bh(root_lock);
+			tp->next = *back;
+			*back = tp;
+			spin_unlock_bh(root_lock);
+		}
 		tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+	} else {
+		if (tp_created)
+			tcf_destroy(tp);
+	}
 
 errout:
 	if (cl)


-- 
Minoru Usui <usui@....nes.nec.co.jp>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html