netdev - Re: [Patch net] net_sched: avoid generating same handle for u32 filters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 20 Jul 2014 20:49:53 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	xiyou.wangcong@...il.com
Cc:	netdev@...r.kernel.org, jhs@...atatu.com, cwang@...pensource.com
Subject: Re: [Patch net] net_sched: avoid generating same handle for u32
 filters

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Thu, 17 Jul 2014 17:34:53 -0700

> From: Cong Wang <cwang@...pensource.com>
> 
> When kernel generates a handle for a u32 filter, it tries to start
> from the max in the bucket. So when we have a filter with the max (fff)
> handle, it will cause kernel always generates the same handle for new
> filters. This can be shown by the following command:
> 
> 	tc qdisc add dev eth0 ingress
> 	tc filter add dev eth0 parent ffff: protocol ip pref 770 handle 800::fff u32 match ip protocol 1 0xff
> 	tc filter add dev eth0 parent ffff: protocol ip pref 770 u32 match ip protocol 1 0xff
> 	...
> 
> we will get some u32 filters with same handle:
> 
>  # tc filter show dev eth0 parent ffff:
> filter protocol ip pref 770 u32 
> filter protocol ip pref 770 u32 fh 800: ht divisor 1 
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0 
>   match 00010000/00ff0000 at 8
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0 
>   match 00010000/00ff0000 at 8
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0 
>   match 00010000/00ff0000 at 8
> filter protocol ip pref 770 u32 fh 800::fff order 4095 key ht 800 bkt 0 
>   match 00010000/00ff0000 at 8
> 
> handles should be unique. This patch fixes it by looking up a bitmap,
> so that can guarantee the handle is as unique as possible. For compatibility,
> we still start from 0x800.
> 
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Signed-off-by: Cong Wang <cwang@...pensource.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied, thank you.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html