netdev - Re: [PATCH net 0/4] mlxsw: Fix ACL actions error condition handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20180803.123543.297036217821560729.davem@davemloft.net>
Date:   Fri, 03 Aug 2018 12:35:43 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     idosch@...lanox.com
Cc:     netdev@...r.kernel.org, jiri@...lanox.com, petrm@...lanox.com,
        nird@...lanox.com, mlxsw@...lanox.com
Subject: Re: [PATCH net 0/4] mlxsw: Fix ACL actions error condition handling

From: Ido Schimmel <idosch@...lanox.com>
Date: Fri,  3 Aug 2018 15:57:40 +0300

> Nir says:
> 
> Two issues were lately noticed within mlxsw ACL actions error condition
> handling. The first patch deals with conflicting actions such as:
> 
>  # tc filter add dev swp49 parent ffff: \
>    protocol ip pref 10 flower skip_sw dst_ip 192.168.101.1 \
>    action goto chain 100 \
>    action mirred egress redirect dev swp4
> 
> The second action will never execute, however SW model allows this
> configuration, while the mlxsw driver cannot allow for it as it
> implements actions in sets of up to three actions per set with a single
> termination marking. Conflicting actions create a contradiction over
> this single marking and thus cannot be configured. The fix replaces a
> misplaced warning with an error code to be returned.
> 
> Patches 2-4 fix a condition of duplicate destruction of resources. Some
> actions require allocation of specific resource prior to setting the
> action itself. On error condition this resource was destroyed twice,
> leading to a crash when using mirror action, and to a redundant
> destruction in other cases, since for error condition rule destruction
> also takes care of resource destruction. In order to fix this state a
> symmetry in behavior is added and resource destruction also takes care
> of removing the resource from rule's resource list.

Series applied, and queued up for -stable.

And thanks especially for the merge conflict heads up.