netdev - Re: [PATCH net] net/sched: cls_u32: fix cls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180208.152905.67063167764180003.davem@davemloft.net>
Date:   Thu, 08 Feb 2018 15:29:05 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     ivecera@...hat.com
Cc:     netdev@...r.kernel.org, ogerlitz@...lanox.com, jiri@...nulli.us,
        xiyou.wangcong@...il.com, jhs@...atatu.com
Subject: Re: [PATCH net] net/sched: cls_u32: fix cls_u32 on filter replace

From: Ivan Vecera <ivecera@...hat.com>
Date: Thu,  8 Feb 2018 16:10:39 +0100

> The following sequence is currently broken:
> 
>  # tc qdisc add dev foo ingress
>  # tc filter replace dev foo protocol all ingress \
>    u32 match u8 0 0 action mirred egress mirror dev bar1
>  # tc filter replace dev foo protocol all ingress \
>    handle 800::800 pref 49152 \
>    u32 match u8 0 0 action mirred egress mirror dev bar2
>  Error: cls_u32: Key node flags do not match passed flags.
>  We have an error talking to the kernel, -1
> 
> The error comes from u32_change() when comparing new and
> existing flags. The existing ones always contains one of
> TCA_CLS_FLAGS_{,NOT}_IN_HW flag depending on offloading state.
> These flags cannot be passed from userspace so the condition
> (n->flags != flags) in u32_change() always fails.
> 
> Fix the condition so the flags TCA_CLS_FLAGS_NOT_IN_HW and
> TCA_CLS_FLAGS_IN_HW are not taken into account.
> 
> Fixes: 24d3dc6d27ea ("net/sched: cls_u32: Reflect HW offload status")
> Signed-off-by: Ivan Vecera <ivecera@...hat.com>

Ugh, private kernel flags are always troublesome for this reason.

Applied and queued up for -stable.