netdev - Re: Possible regression due to "net/sched: cls_flower: Add offload support using egress Hardware device"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20161203175410.GA2147@penelope.horms.nl>
Date:   Sat, 3 Dec 2016 18:54:12 +0100
From:   Simon Horman <simon.horman@...ronome.com>
To:     Or Gerlitz <gerlitz.or@...il.com>
Cc:     Hadar Hen Zion <hadarh@...lanox.com>,
        Linux Netdev List <netdev@...r.kernel.org>,
        Roi Dayan <roid@...lanox.com>, Amir Vadai <amir@...ai.me>
Subject: Re: Possible regression due to "net/sched: cls_flower: Add offload
 support using egress Hardware device"

On Sat, Dec 03, 2016 at 06:06:08PM +0200, Or Gerlitz wrote:
> On Sat, Dec 3, 2016 at 3:17 PM, Simon Horman <horms@...ge.net.au> wrote:
> 
> > in net-next I am observing what appears to be an regression in net-next due to:
> > 7091d8c7055d ("net/sched: cls_flower: Add offload support using egress Hardware device")
> >
> > The problem occurs when adding a flower filter (without offload to a virtio device).
> 
> > # ethtool -d eth0
> > ethtool -i eth0
> > driver: virtio_net
> 
> > # tc qdisc add dev eth0 ingress
> > # tc filter add dev eth0 protocol ip parent ffff: flower indev eth0
> > [  104.302779] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d5
> 
> Simon, I don't see an action here, is that missing in purpose? wasn't
> sure what such filter does, but ofcourse
> if it was supported by the patches it has to be so after changing
> things as well, we will check and fix.
> 

Hi Or,

sorry, I trimmed the action by mistake when trying to make a minimal test
case. Originally I noticed this bug with something like the following:

tc filter add dev eth0 protocol ip parent ffff: flower indev eth0 ip_proto udp dst_port 53 action drop

I don't think the fields flower is matching on or the action are
particularly important when trying to reproduce the problem. But I could be
wrong.