netdev - Re: [Patch net] net_sched: fix struct tc_u

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1425946393.8261.24.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Mon, 09 Mar 2015 17:13:13 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Cong Wang <xiyou.wangcong@...il.com>
Cc:	netdev@...r.kernel.org, Jamal Hadi Salim <jhs@...atatu.com>,
	John Fastabend <john.fastabend@...il.com>
Subject: Re: [Patch net] net_sched: fix struct tc_u_hnode layout in u32

On Mon, 2015-03-09 at 17:03 -0700, Cong Wang wrote:
> We dynamically allocate divisor+1 entries for ->ht[] in tc_u_hnode:
> 
>   ht = kzalloc(sizeof(*ht) + divisor*sizeof(void *), GFP_KERNEL);
> 
> So ->ht is supposed to be the last field of this struct, however
> this is broken, since an rcu head is appended after it.
> 
> Fixes: 1ce87720d456 ("net: sched: make cls_u32 lockless")
> Cc: Jamal Hadi Salim <jhs@...atatu.com>
> Cc: John Fastabend <john.fastabend@...il.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
> ---
>  net/sched/cls_u32.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
> index 09487af..95fdf4e 100644
> --- a/net/sched/cls_u32.c
> +++ b/net/sched/cls_u32.c
> @@ -78,8 +78,11 @@ struct tc_u_hnode {
>  	struct tc_u_common	*tp_c;
>  	int			refcnt;
>  	unsigned int		divisor;
> -	struct tc_u_knode __rcu	*ht[1];
>  	struct rcu_head		rcu;
> +	/* The 'ht' field MUST be the last field in structure to allow for
> +	 * more entries allocated at end of structure.
> +	 */
> +	struct tc_u_knode __rcu	*ht[1];
>  };

Good catch.

Definitely a call to make this a flexible array in net-next (ht[]), so
that compiler would have catch the bug.

Acked-by: Eric Dumazet <edumazet@...gle.com>




--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html